fix: an open popup follows a network switch the background saves (closes #650)

When the background saves a network switch after the user approves a
site's request, or another popup page saves one, an open popup takes the
new network from the stored record inside a save, holding the lock, and
checks the record once at start-up for a switch saved before it
listened. It then leaves the page as a switch in Settings does: the cut
and the redraw are two Settings functions both paths call, and both
reset the popup's caches through one function. A switch in Settings is
now made inside its own save too, so one picked while a follow waits for
the lock is made after it. The popup never switches the network itself.

Model: opus-5-5

README.md

@@ -461,13 +461,15 @@ address, the transaction assertions run against the raw signed transaction
 captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
-stored network unchanged and send no `chainChanged` until it is approved, a
-network switch in Settings is required to send the page `chainChanged` with the
-new chain id, a prompt raised while another approval window has focus is
-required to open a window of its own, and the password is required to be absent
-from every message the approval window sends to the background — with the
-message that would carry it required to be present, so that check cannot pass by
-observing nothing. That last one is the standing floor under
+stored network unchanged and send no `chainChanged` until it is approved, the
+popup open all along is required to show the `[TESTNET]` banner once a switch to
+Sepolia is approved and to drop it once the switch back is, a network switch in
+Settings is required to send the page `chainChanged` with the new chain id, a
+prompt raised while another approval window has focus is required to open a
+window of its own, and the password is required to be absent from every message
+the approval window sends to the background — with the message that would carry
+it required to be present, so that check cannot pass by observing nothing. That
+last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -603,9 +605,10 @@ suite), wallet creation through the UI, the Add Token screen, and the dApp round
 trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
 rejected and then approved, `eth_sendTransaction`, and a closed approval window
 rejecting with EIP-1193 4001 — driven through the real content script,
-background page and approval windows. The `personal_sign` prompt is also
-required to fit its window without scrolling sideways, with the extension's
-pages at 170% zoom.
+background page and approval windows. The popup open all along is required to
+show the `[TESTNET]` banner once the switch to Sepolia is approved and to drop
+it once the switch back is. The `personal_sign` prompt is also required to fit
+its window without scrolling sideways, with the extension's pages at 170% zoom.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -1129,13 +1132,15 @@ scale is not an approximation but a different number — 1,000 units of a
 6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
 whose only job is to state what is being authorized. Both amount paths of that
 screen take this rule: the ERC-20 `transfer`/`approve` line
-(`src/popup/views/approval.js`) and the swap's `Amount` and `Min. received`
-lines (`src/shared/uniswap.js`). The token permission warning on the signature
-screen takes the same rule for its amounts. An unbounded allowance or permit
-needs no scale to describe and is still shown as `Unlimited`. A source's answer
-counts only if it is a whole number from 0 to 80: `decimals()` returns a
-`uint8`, but `formatUnits()` cannot format more than 80 decimal places, so a
-token that reports 81 to 255 is shown as one whose scale nothing knows.
+(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
+`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
+a move into the router (`src/shared/uniswap.js`). The token permission warning
+on the signature screen takes the same rule for its amounts. An unbounded
+allowance or permit needs no scale to describe and is still shown as
+`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
+`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
+decimal places, so a token that reports 81 to 255 is shown as one whose scale
+nothing knows.
 
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1562,20 +1567,29 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 
-A network switch in Settings leaves every screen beneath Settings showing the
-previous network, so after it "Back" behaves as in a reopened popup: every
-screen on the stack counts as not yet rendered, and the stack is cut at the
-first screen that cannot be rendered from saved state, such as Send or AddToken,
-or at AddressToken for any token but the native one, because that token was
-picked on the previous network. The cut stack is saved with the switch, so a
-popup closed straight after it and reopened onto Settings lands in the same
-place. "Back" then renders the screen it lands on for the new network, and
-anything typed there and not saved, which belonged to the previous network, is
-dropped. ConfirmTx, WaitTx, SuccessTx, ErrorTx and TransactionDetail are
-rendered instead for the network of the transaction they show: the network it
-was reviewed on for ConfirmTx, and the network it was sent on for the others.
-Without a wallet the stack is not cut, because it starts at Welcome, which shows
-nothing from a network.
+A network switch leaves every screen on the page showing the previous network.
+The user makes it in Settings, or approves a site's request and the background
+saves it. Any other popup open meanwhile takes the switch from the stored
+record, even one saved while it was opening, and never switches the network
+itself. A switch the user picks in its Settings while it takes one is made after
+it, not overwritten by it. An approval window does not take the switch. After
+the switch, whichever way the page got it, "Back" behaves as in a reopened
+popup: every screen on the stack counts as not yet rendered, and the stack is
+cut at the first screen that cannot be rendered from saved state, such as Send
+or AddToken, or at AddressToken for any token but the native one, because that
+token was picked on the previous network and is no longer selected. The cut
+stack is saved with the popup's new network, so a popup closed straight after
+and reopened lands in the same place. The screen on top is drawn again for the
+new network: Settings in place, and any other screen as a reopened popup draws
+it, so Home takes the place of one that cannot be rendered from saved state or
+of AddressToken for a token no longer selected. "Back" then renders the screen
+it lands on for the new network, and anything typed there and not saved, which
+belonged to the previous network, is dropped. ConfirmTx, WaitTx, SuccessTx,
+ErrorTx and TransactionDetail are rendered instead for the network of the
+transaction they show: the network it was reviewed on for ConfirmTx, and the
+network it was sent on for the others. Without a wallet the stack is not cut and
+only Settings is drawn again, because the stack starts at Welcome, and Welcome
+and AddWallet show nothing from a network.
 
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
@@ -2425,10 +2439,11 @@ view would leave a wallet one click from deletion.
       transaction"
     - Decoded action (if calldata is recognized): action name, token details,
       amounts, what each swap step spends that the `Amount` line does not give,
-      what each `PERMIT2_TRANSFER_FROM` moves and where to, steps, deadline, and
-      unless a swap pays only the From address, a `Paid to` line for each other
-      address it pays, or saying that a token stays in the router or who it pays
-      is unknown (see Transaction Decoding)
+      what each `PERMIT2_TRANSFER_FROM` moves and where to, what each
+      `PERMIT2_PERMIT` whose amount is not the `Amount` figure lets its spender
+      take, steps, deadline, and unless a swap pays only the From address, a
+      `Paid to` line for each other address it pays, or saying that a token
+      stays in the router or who it pays is unknown (see Transaction Decoding)
     - From: color dot + full address + etherscan link
     - Contract: color dot + full address + etherscan link, token symbol label if
       known; for a contract creation, the same sentence as on WaitTx
@@ -3217,40 +3232,42 @@ Currently supported:
   added to the total while both are quantities: a V3 exact-in of 600 USDT and a
   V2 exact-in of 400 USDT, both paid by the user, read `1000.0000 USDT`. When
   the decoder does not know a take's amount, the total is not known and there is
-  no `Amount` line. `Token In` is the token of the last `PERMIT2_PERMIT` the
-  decoder reads, when there is one. Its amount, `Unlimited` included, stands as
-  the `Amount` figure in place of the total only in the plain shape of Uniswap's
-  own routes: it is the only `PERMIT2_PERMIT`, its spender is the router, the
-  router may not let it fail, no step before it takes its token or a token the
-  decoder does not know, and the decoder reads every step after it in full.
-  Permit2 then lets the router take no more of the token than that amount, so
-  the permit covers every take of it. A step the decoder does not read in full
-  may raise what Permit2 lets the router take, as a `PERMIT2_PERMIT_BATCH` can:
-  a command the decoder does not read (listed at the end of this section), a
-  step whose input it cannot read, in whole or in part, and a step it fails on.
-  In any other case the line gives the total, as with no permit. When the step
-  that sets the input side spends a token other than the permit's, or one the
-  decoder does not know, its amount gets lines of its own, unless it states no
-  amount and the user pays it none of its input token, and the total has no
-  figure to start from: unless the permit's amount stands there is no `Amount`
-  line, and each take of the permit's token gets lines of its own. Each take the
-  total does not count gives three lines after the `Amount` line (after
-  `Token In` when there is none): one of a token other than `Token In`; one of
-  `Token In` after an amount that is not a quantity (a V4 open delta,
-  `ALREADY_PAID`, which keep their wording on the `Amount` line, or no stated
-  amount, as of a V4 exact-out step); and one whose amount the decoder does not
-  know. When the step that sets the input side states no amount, the user pays
-  it some of its input token, and there is no `Amount` line, that step gets them
-  too whenever another take's lines give a figure, or a `PERMIT2_TRANSFER_FROM`
-  of its token gives one, on the lines below or, into the router, on its
-  `Paid to` line, so that figure cannot read as all that leaves. When it states
-  no amount and the user pays it none of its input token, as when the router
-  pays it, that step takes none of that token from the user's wallet and never
-  gets them, with a permit or without. They come in step order, the step that
-  sets the input side first when it has them: `Moved from the sender`, its
-  amount, worded as the `Amount` line words one, or
-  `Unknown (could not be decoded)` when the decoder does not know it;
-  `Token moved`, giving the token's address as the `Token In` line does; and
+  no `Amount` line. A `PERMIT2_PERMIT` names `Token In` only when its amount,
+  `Unlimited` included, stands as the `Amount` figure in place of the total,
+  which it does only in the plain shape of Uniswap's own routes: it comes before
+  the step that sets the input side, it is the only `PERMIT2_PERMIT` in the
+  transaction, its spender is the router, the router may not let it fail, no
+  step before it takes its token or a token the decoder does not know, and the
+  decoder reads every step after it in full. Permit2 then lets the router take
+  no more of the token than that amount, so the permit covers every take of it.
+  A step the decoder does not read in full may raise what Permit2 lets the
+  router take, as a `PERMIT2_PERMIT_BATCH` can: a command the decoder does not
+  read (listed at the end of this section), a step whose input it cannot read,
+  in whole or in part, and a step it fails on. Every other `PERMIT2_PERMIT`,
+  before the step that sets the input side or after it, leaves `Token In` and
+  the `Amount` line as they read with no permit: a permit of 5,000 DAI to
+  another address and then a V3 exact-in of 600 USDT read `Swap USDT → USDC`
+  with `Amount 600.0000 USDT`, and so do that exact-in and then a permit of
+  5,000 DAI to the router. When a permit's amount stands and the step that sets
+  the input side spends a token other than the permit's, or one the decoder does
+  not know, that step's amount gets lines of its own, unless it states no amount
+  and the user pays it none of its input token. Each take the total does not
+  count gives three lines after the `Amount` line (after `Token In` when there
+  is none): one of a token other than `Token In`; one of `Token In` after an
+  amount that is not a quantity (a V4 open delta, `ALREADY_PAID`, which keep
+  their wording on the `Amount` line, or no stated amount, as of a V4 exact-out
+  step); and one whose amount the decoder does not know. When the step that sets
+  the input side states no amount, the user pays it some of its input token, and
+  there is no `Amount` line, that step gets them too whenever another take's
+  lines give a figure, or a `PERMIT2_TRANSFER_FROM` of its token gives one, on
+  the lines below or, into the router, on its `Paid to` line, so that figure
+  cannot read as all that leaves. When it states no amount and the user pays it
+  none of its input token, as when the router pays it, that step takes none of
+  that token from the user's wallet and never gets them, with a permit or
+  without. They come in step order, the step that sets the input side first when
+  it has them: `Moved from the sender`, its amount, worded as the `Amount` line
+  words one, or `Unknown (could not be decoded)` when the decoder does not know
+  it; `Token moved`, giving the token's address as the `Token In` line does; and
   `Moved to`, which reads `The swap step that spends it`. A token the decoder
   does not know gives the `Moved from the sender` line alone. A step may also
   take from the user's wallet what the decoder did not read: a V4 step whose
@@ -3271,11 +3288,19 @@ Currently supported:
   on every router but `UniversalRouterV1`, and otherwise gives the address. A
   move into the router needs none of them, because its `Paid to` line and
   `Token moved into the router` line already give the amount, the token and
-  where it goes, and so its amount is shown once. These lines change neither the
-  `Paid to` lines nor the minimum's label. A step goes unread when its recipient
-  does not decode as an address, when it is a V3 swap step whose path is shorter
-  than one token address or has bytes after its last hop, or when it is a
-  command the decoder does not read: every command other than `PERMIT2_PERMIT`,
+  where it goes, and so its amount is shown once. Every `PERMIT2_PERMIT` whose
+  amount does not stand as the `Amount` figure, before the step that sets the
+  input side or after it, gives three lines, in step order, after those for each
+  `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
+  `5000.0000 DAI`, or `Unlimited` for Permit2's maximum; `Allowance token`,
+  giving the token's address as the `Token In` line does; and
+  `Allowance spender`, the address it lets take the token. Only a permit whose
+  amount stands gives none: the `Amount` line gives its amount, `Token In` its
+  token, and its spender is the router. These lines change neither the `Paid to`
+  lines nor the minimum's label. A step goes unread when its recipient does not
+  decode as an address, when it is a V3 swap step whose path is shorter than one
+  token address or has bytes after its last hop, or when it is a command the
+  decoder does not read: every command other than `PERMIT2_PERMIT`,
   `PERMIT2_TRANSFER_FROM`, `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`,
   `V3_SWAP_EXACT_IN`, `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`,
   `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`,

src/popup/index.js

@@ -11,6 +11,8 @@ const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
+const { copyChainSwitchFields } = require("../shared/chainSwitchFields");
+const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
     $,
     showView,
@@ -22,6 +24,7 @@ const {
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 const {
+    onStorageChanged,
     tabsGetCurrent,
     tabsGetZoom,
     windowsGetCurrent,
@@ -72,12 +75,13 @@ let refreshTimer = null;
 // lock, its results are copied onto the address records in `state` only if the
 // network it ran on is still the active one, on this page and in the stored
 // record; the background's switch, after the user approves a site's request,
-// changes only the stored record. A switch while the refresh ran cleared every
-// address's balances (applyChainSwitchFields() in
-// src/shared/chainSwitchFields.js), and the previous network's must not come
-// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped
-// refresh is not recorded as done. Results are copied by address, so an address
-// added or removed meanwhile is left as it is.
+// reaches this page only after the stored record (followNetworkSwitch() below).
+// A switch while the refresh ran cleared every address's balances
+// (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
+// previous network's must not come back over them
+// (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
+// recorded as done. Results are copied by address, so an address added or
+// removed meanwhile is left as it is.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
@@ -147,6 +151,7 @@ const ctx = {
     renderWalletList,
     doRefreshAndRender,
     startRefresh,
+    restoreView,
     pageClosed: pageClosed.signal,
     showAddWalletView: () => {
         pushCurrentView();
@@ -214,6 +219,28 @@ function fallbackView() {
     showView("main");
 }
 
+// When the background saves a network switch, once the user approves a site's
+// request, or another popup page saves one, this page follows the stored
+// record. It takes the network the record names as a save reads it, holding
+// the lock, so no later save of this page writes the previous network back, and
+// then leaves the page as a switch in Settings leaves it. This page's own
+// switch in Settings is made under the lock as well (onChainSwitch() in
+// src/shared/chainSwitch.js), so a record naming a network other than this
+// page's always holds a switch saved elsewhere, and a switch the user picks
+// here while this waits for the lock is made after it.
+async function followNetworkSwitch() {
+    let switched = false;
+    // A failed save is reported by saveState() itself: see onSaveFailure().
+    await saveState((stored) => {
+        if (stored.networkId === state.networkId) return false;
+        settings.cutViewStack();
+        copyChainSwitchFields(state, stored);
+        clearPopupCaches();
+        switched = true;
+    }).catch(() => {});
+    if (switched) settings.showNewNetwork();
+}
+
 // The background opens the approval window as wide as the page, but the
 // browser counts the window's frame in that width, and a screen taller than
 // the window takes a vertical scrollbar out of it too. So once the screen is
@@ -358,6 +385,17 @@ async function init() {
     settingsAddToken.init(ctx);
     deleteAddress.init(ctx);
 
+    // Only a record naming a network other than this page's is followed: the
+    // one this page's own switch in Settings saves names the network it
+    // already has, and a record naming none is no switch.
+    onStorageChanged((changes) => {
+        const written = changes.autistmask && changes.autistmask.newValue;
+        if (!written || !written.networkId) return;
+        if (written.networkId !== state.networkId) followNetworkSwitch();
+    });
+    // A switch saved since loadState() above, before there was a listener.
+    followNetworkSwitch();
+
     if (!state.hasWallet) {
         showView("welcome");
     } else {

src/popup/viewRouter.js

@@ -39,8 +39,8 @@ function markViewRendered(view) {
 }
 
 // Begin a fresh page-load scope. The popup gets one by being loaded, and
-// asks for one when the user switches the network, because every screen
-// then on the page shows the previous network (views/settings.js); the
+// asks for one after a network switch, because every screen then on the page
+// shows the previous network (showNewNetwork() in views/settings.js); the
 // unit tests, which simulate several page loads against one module
 // instance, ask for one too.
 function resetRenderedViews() {

src/popup/views/settings.js

@@ -38,6 +38,8 @@ const {
 
 const { notify, sendMessage } = require("../../shared/browserApi");
 
+let ctx;
+
 let versionClickCount = 0;
 let versionClickTimer = null;
 
@@ -243,7 +245,51 @@ async function renderSiteLists() {
     );
 }
 
-function init(ctx) {
+// A network switch, made by the user here or saved by the background once the
+// user approved a site's request (src/popup/index.js), leaves every screen on
+// the page showing the previous network. These two leave the page as README's
+// Screen Map describes, the first before the switch is saved, so that save
+// keeps the cut for a popup closed straight after, the second once `state`
+// holds the new network.
+//
+// The stack is cut at the first screen that cannot be rendered from saved
+// state, such as Send or AddToken, and at AddressToken unless it shows the
+// native token: any other token there was picked on the previous network, so
+// it is no longer selected either. Without a wallet the stack starts at
+// Welcome, which that cut would drop, and Welcome shows nothing from a network.
+function cutViewStack() {
+    if (!state.hasWallet) return;
+    if (state.selectedToken !== "ETH") {
+        const tokenView = state.viewStack.indexOf("address-token");
+        if (tokenView !== -1) {
+            state.viewStack = state.viewStack.slice(0, tokenView);
+        }
+        state.selectedToken = null;
+    }
+    state.viewStack = restorableStack(state.viewStack, state.currentView);
+}
+
+// Every screen counts as not yet rendered, so "Back" renders the one it lands
+// on for the new network. Settings on top is brought up to date in place;
+// any other screen is drawn again as a reopened popup draws it, which is Home
+// for one that cannot be rendered from saved state. Without a wallet any other
+// screen is Welcome or AddWallet, which show nothing from a network.
+function showNewNetwork() {
+    resetRenderedViews();
+    if (state.currentView === "settings") {
+        markViewRendered("settings");
+        $("settings-network").value = state.networkId;
+        $("settings-rpc").value = state.rpcUrl;
+        $("settings-blockscout").value = state.blockscoutUrl;
+        renderTrackedTokens();
+    } else if (state.hasWallet) {
+        ctx.restoreView();
+    }
+    updateDebugBanner(state.currentView);
+}
+
+function init(_ctx) {
+    ctx = _ctx;
     deleteWallet.init(ctx);
     showPhrase.init();
 
@@ -319,37 +365,18 @@ function init(ctx) {
 
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
+        // Whether `state` already has the network picked is asked only once
+        // the switch holds the lock: while an earlier pick waits for it,
+        // `state` still has the network before that pick, and a pick back to
+        // that network must still be made.
         const newId = networkSelect.value;
-        if (newId === state.networkId) return;
-        // The screens beneath Settings show the previous network, so Back
-        // finds them as it does in a reopened popup: each is rendered again
-        // when Back lands on it, and the stack is cut at the first one that
-        // cannot be rendered from saved state, such as Send or AddToken. It
-        // is cut at AddressToken too, unless that shows the native token: any
-        // other token there was picked on the previous network. Without a
-        // wallet the stack starts at Welcome, which that cut would drop, and
-        // Welcome shows nothing from a network. The cut comes before the
-        // switch so that the switch's save keeps it for a popup closed
-        // straight after.
-        if (state.hasWallet) {
-            const tokenView = state.viewStack.indexOf("address-token");
-            if (tokenView !== -1 && state.selectedToken !== "ETH") {
-                state.viewStack = state.viewStack.slice(0, tokenView);
-            }
-            state.viewStack = restorableStack(state.viewStack, "settings");
-        }
+        cutViewStack();
         const net = await onChainSwitch(newId);
+        if (!net) return;
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        resetRenderedViews();
-        // Settings itself, and the testnet banner above it, are brought up
-        // to date for the new network here.
-        markViewRendered("settings");
-        $("settings-rpc").value = state.rpcUrl;
-        $("settings-blockscout").value = state.blockscoutUrl;
-        renderTrackedTokens();
-        updateDebugBanner(state.currentView);
+        showNewNetwork();
         showFlash("Switched to " + net.name + ".");
     });
 
@@ -484,4 +511,10 @@ function init(ctx) {
     });
 }
 
-module.exports = { init, show, renderSiteLists };
+module.exports = {
+    init,
+    show,
+    renderSiteLists,
+    cutViewStack,
+    showNewNetwork,
+};

src/shared/browserApi.js

@@ -224,6 +224,19 @@ function storageRemove(keys) {
     return Promise.resolve(storage.remove(keys));
 }
 
+/**
+ * Call `listener` after every write to `storage.local`, whether this page,
+ * another page or the background made it, with what the write changed, as the
+ * browser reports it: `{ [key]: { oldValue, newValue } }`.
+ *
+ * @param {function(Object): void} listener
+ */
+function onStorageChanged(listener) {
+    namespaceMember("storage").onChanged.addListener((changes, areaName) => {
+        if (areaName === "local") listener(changes);
+    });
+}
+
 /**
  * Run `fn` while holding the browser's lock called `name`
  * (`navigator.locks`), and settle as `fn` settles. Every page of the extension
@@ -385,6 +398,7 @@ module.exports = {
     getPlatformInfo,
     hasBrowserNamespace,
     notify,
+    onStorageChanged,
     runtimeApi,
     sendMessage,
     sessionStorageGet,

src/shared/chainSwitch.js

@@ -1,8 +1,17 @@
-// Consolidated chain-switch handler for the popup.
+// The popup's network switch.
 //
-// Every state change required when the active network changes is
-// performed here so that callers (settings UI, future chain additions) all go
-// through a single code path.
+// A network switch reaches the popup's `state` in one of two ways:
+//
+// - onChainSwitch() below makes the switch the user picks in Settings, with
+//   applyChainSwitchFields() (chainSwitchFields.js).
+// - followNetworkSwitch() in src/popup/index.js takes a switch the background
+//   or another popup page saved, from the stored record, with
+//   copyChainSwitchFields() (chainSwitchFields.js).
+//
+// Both change `state` inside a save, holding the lock, and both reset the
+// popup's own caches through clearPopupCaches(), so a reset added there
+// reaches both. A field applyChainSwitchFields() sets has to be copied by
+// copyChainSwitchFields() too.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
@@ -20,22 +29,32 @@
 const { applyChainSwitchFields } = require("./chainSwitchFields");
 const { clearPrices } = require("./prices");
 
+// The popup's own caches a network switch resets. Prices are chain-specific
+// (testnet tokens are worthless, ETC has different pricing, etc.). In-memory
+// and per bundle, so this is the popup's own cache — the only context that
+// ever fills it.
+function clearPopupCaches() {
+    clearPrices();
+}
+
 // Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain.
+// Returns the network configuration object for the new chain, or null when
+// `state` already has that network once the save holds the lock, and nothing
+// is switched.
+//
+// `state` is switched inside the save that stores the switch, holding the
+// lock, so it is never switched while a follow of a switch saved elsewhere
+// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
+// follow runs first, and this switch is made after it.
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");
-
-    const net = applyChainSwitchFields(state, newNetworkId);
-
-    // --- price cache ---
-    // Prices are chain-specific (testnet tokens are worthless,
-    // ETC has different pricing, etc.). In-memory and per bundle, so this is
-    // the popup's own cache — the only context that ever fills it.
-    clearPrices();
-
-    await saveState();
-
+    let net = null;
+    await saveState(() => {
+        if (state.networkId === newNetworkId) return false;
+        net = applyChainSwitchFields(state, newNetworkId);
+        clearPopupCaches();
+    });
     return net;
 }
 
-module.exports = { onChainSwitch };
+module.exports = { onChainSwitch, clearPopupCaches };

src/shared/chainSwitchFields.js

@@ -7,7 +7,7 @@
 // the singleton and saves; the background applies it to the detached record of
 // its own read-modify-write (src/background/state.js).
 //
-// Everything here is synchronous and touches nothing but the object it is
+// Everything here is synchronous and touches nothing but the objects it is
 // given: no storage, no caches, no imports beyond the network table. That is
 // what makes it usable on a record that has been read fresh from storage
 // microseconds earlier and is about to be written back.
@@ -76,4 +76,32 @@ function applyChainSwitchFields(s, newNetworkId) {
     return net;
 }
 
-module.exports = { applyChainSwitchFields };
+// Give `s` every field applyChainSwitchFields() sets, as `switched` holds it:
+// the popup takes a switch the background saved from the stored record this
+// way, rather than performing it again (src/popup/index.js). Balances are
+// taken by address, and an address `switched` does not have keeps none.
+function copyChainSwitchFields(s, switched) {
+    s.networkEndpoints = switched.networkEndpoints;
+    s.networkTrackedTokens = switched.networkTrackedTokens;
+    s.trackedTokens = switched.trackedTokens;
+    s.networkId = switched.networkId;
+    s.rpcUrl = switched.rpcUrl;
+    s.blockscoutUrl = switched.blockscoutUrl;
+    s.lastBalanceRefresh = switched.lastBalanceRefresh;
+    s.tokenHolderCache = switched.tokenHolderCache;
+    s.fraudContracts = switched.fraudContracts;
+
+    const stored = new Map();
+    for (const wallet of switched.wallets) {
+        for (const addr of wallet.addresses) stored.set(addr.address, addr);
+    }
+    for (const wallet of s.wallets) {
+        for (const addr of wallet.addresses) {
+            const got = stored.get(addr.address);
+            addr.balance = got ? got.balance : "0";
+            addr.tokenBalances = got ? got.tokenBalances : [];
+        }
+    }
+}
+
+module.exports = { applyChainSwitchFields, copyChainSwitchFields };

src/shared/state.js

@@ -466,7 +466,9 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current.
+// before this fix; only the persisted record is guaranteed current. The
+// network is the exception: the popup takes a switch another context saved
+// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
 async function saveStateOnce(beforeWrite) {
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written

src/shared/uniswap.js

@@ -494,8 +494,9 @@ function amountText(raw, info) {
     };
 }
 
-// The line giving a moved token under `label`, in the shape of the Token In
-// line, so the screens show it as they show that one. ETH has no address.
+// The line giving a moved token, or the token of a permit, under `label`, in
+// the shape of the Token In line, so the screens show it as they show that
+// one. ETH has no address.
 function tokenMovedLine(label, token, sources) {
     const info = tokenInfo(token, sources);
     if (!present(info.address)) {
@@ -596,12 +597,14 @@ function decodeV2SwapExactOut(input) {
 // token(20) ...), or null when it is not one token followed by whole hops of
 // a fee and a token (40 hex digits, then 46 per hop). The router reads only
 // whole hops and ignores any bytes after the last one, so the last 20 bytes
-// of such a path are not the token it reads there.
+// of such a path are not the token it reads there. Both are checksummed, as
+// the ABI decoder gives every other address, so a token reads the same on
+// every line.
 function decodeV3Path(pathHex) {
     const hex = pathHex.startsWith("0x") ? pathHex.slice(2) : pathHex;
     if (hex.length < 40 || (hex.length - 40) % 46 !== 0) return null;
-    const first = "0x" + hex.slice(0, 40);
-    const last = "0x" + hex.slice(-40);
+    const first = getAddress("0x" + hex.slice(0, 40));
+    const last = getAddress("0x" + hex.slice(-40));
     return { first, last };
 }
 
@@ -1208,9 +1211,14 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // its input currency (see decodeV4Swap()). Only a V4 step can set the
         // input side with no amount, the one case in which this is read.
         let inputPaidByUser = false;
-        // The last PERMIT2_PERMIT this decoder read, or null (see
-        // permitStands after the loop).
+        // The last PERMIT2_PERMIT this decoder read before a step set the
+        // input side, or null (see permitStands after the loop).
         let permit = null;
+        // Every PERMIT2_PERMIT this decoder read, before a step set the input
+        // side or after, in step order, as { token, amount, spender, step }.
+        // Each whose amount is not the Amount figure gets lines of its own
+        // (see after the PERMIT2_TRANSFER_FROM lines).
+        const permits = [];
         // The index of each step this decoder did not read in full: a
         // command it does not read, a step whose input it cannot read, in
         // whole or in part, and one it fails on (see permitStands).
@@ -1268,8 +1276,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // when no earlier hop set it. A half the establishing hop did not
         // state stays null and the line says so, rather than being filled in
         // from a different hop. A PERMIT2_PERMIT sets no side here: after the
-        // loop, the last one read names Token In, and the Amount line is
-        // formed there, in one place (see permitStands).
+        // loop, one whose amount stands as the Amount figure names Token In,
+        // and the Amount line is formed there, in one place (see
+        // permitStands).
         const setInput = (token, amount) => {
             inputToken = present(token) ? token : null;
             inputAmount = present(amount) ? amount : null;
@@ -1465,24 +1474,33 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 } else if (command === "PERMIT2_PERMIT") {
                     const p = decodePermit2(inputs[i]);
                     if (p) {
+                        permits.push({ ...p, step: i });
+                        keepsRouterWeth = true;
+                    } else {
+                        stepsUnread.push(i);
+                    }
+                    // Only a permit whose amount stands as the Amount figure
+                    // names Token In (see permitStands). Every other permit,
+                    // before the step that sets the input side or after it,
+                    // leaves Token In and Amount as they read with no permit
+                    // and gets lines of its own. One after a step set the input
+                    // side never stands, so only one before it is kept here.
+                    if (p && !inputEstablished) {
                         // Whether a step before it took its token, or may
-                        // have: the step that set the input side or one in
-                        // `userPaid`, when its token is the permit's or not
-                        // known.
+                        // have: one in `userPaid`, when its token is the
+                        // permit's or not known. No step has set the input
+                        // side yet.
                         const mayBeItsToken = (token) =>
                             !present(token) || sameAddress(token, p.token);
-                        const tookBefore =
-                            (inputEstablished && mayBeItsToken(inputToken)) ||
-                            userPaid.some((t) => mayBeItsToken(t.token));
+                        const tookBefore = userPaid.some((t) =>
+                            mayBeItsToken(t.token),
+                        );
                         permit = {
                             ...p,
                             step: i,
                             allowedToFail,
                             beforeEveryTake: !tookBefore,
                         };
-                        keepsRouterWeth = true;
-                    } else {
-                        stepsUnread.push(i);
                     }
                 } else if (command === "PERMIT2_TRANSFER_FROM") {
                     const p = decodePermit2TransferFrom(inputs[i]);
@@ -1939,18 +1957,21 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // lines of its own. One whose amount is not known also leaves the
         // total unknown, with no figure.
         //
-        // The last PERMIT2_PERMIT read names Token In. Its amount stands as
-        // the Amount figure in place of the total only in the plain shape of
-        // Uniswap's own routes: it is the only PERMIT2_PERMIT, its spender is
-        // the router, the router may not let it fail, no step before it took
-        // its token or one not known, and this decoder read every step after
-        // it in full (see stepsUnread). Permit2 then lets the router take no
-        // more of the token than that amount, so the permit covers every take
-        // of it. A later step this decoder did not read may raise what Permit2
-        // lets the router take, as a PERMIT2_PERMIT_BATCH can. A step that
-        // may take from the sender what this decoder did not read leaves no
-        // figure, permit or not (see spentUnread()), and an EXECUTE_SUB_PLAN
-        // step leaves both sides unknown (below).
+        // A PERMIT2_PERMIT names Token In only when its amount stands as the
+        // Amount figure in place of the total, which it does only in the
+        // plain shape of Uniswap's own routes: it comes before the step that
+        // set the input side, it is the only PERMIT2_PERMIT in the
+        // transaction, its spender is the router, the router may not let it
+        // fail, no step before it took its token or one not known, and this
+        // decoder read every step after it in full (see stepsUnread). Permit2
+        // then lets the router take no more of the token than that amount, so
+        // the permit covers every take of it. A later step this decoder did
+        // not read may raise what Permit2 lets the router take, as a
+        // PERMIT2_PERMIT_BATCH can. Every other PERMIT2_PERMIT leaves Token In
+        // and the Amount line as they read with no permit, and gets lines of
+        // its own below. A step that may take from the sender what this decoder
+        // did not read leaves no figure, permit or not (see spentUnread()),
+        // and an EXECUTE_SUB_PLAN step leaves both sides unknown (below).
         const stepCommands = Array.from(
             commandsBytes,
             (b) => commands[b & commandTypeMask],
@@ -1977,17 +1998,17 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // The take of the step that set the input side, when the total
         // starts from it and it stated no amount (see below), or null.
         let firstTakeUnstated = null;
-        if (permit === null || sameAddress(inputToken, permit.token)) {
+        if (!permitStands || sameAddress(inputToken, permit.token)) {
             total = inputAmount;
             if (hasFirstTake && !present(inputAmount)) {
                 firstTakeUnstated = { token: inputToken, amount: null };
             }
         } else if (hasFirstTake) {
             // The step that set the input side spent a token other than the
-            // permit's, or one not known, so the total starts with no figure.
+            // permit's, or one not known, so its amount gets lines of its own.
             spentFromSender.push({ token: inputToken, amount: inputAmount });
         }
-        if (permit !== null) inputToken = permit.token;
+        if (permitStands) inputToken = permit.token;
         for (const t of userPaid) {
             const ofTokenIn = sameAddress(t.token, inputToken);
             if (ofTokenIn && permitStands) continue;
@@ -2020,10 +2041,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         }
 
         // The commands of an EXECUTE_SUB_PLAN step may spend the user's tokens
-        // or pay the user, before or after any other step, and a permit among
-        // them would name Token In. What the other steps state is
-        // then not the whole swap, so both sides are set unknown, with no
-        // figure, wherever the step stands.
+        // or pay the user, before or after any other step. What the other
+        // steps state is then not the whole swap, so both sides are set
+        // unknown, with no figure, wherever the step stands.
         if (hasSubPlan) {
             inputToken = null;
             inputAmount = null;
@@ -2181,6 +2201,32 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             );
         }
 
+        // What each PERMIT2_PERMIT lets its spender take: its amount, its
+        // token and the spender, an address on a line of its own. Permit2's
+        // maximum is unbounded. Only a permit whose amount stands as the
+        // Amount figure (see permitStands) gets none: that line already gives
+        // its amount and Token In its token, and its spender is the router.
+        // Every other permit, one after the step that set the input side
+        // included, gets these lines, so nothing it lets anyone take goes
+        // unstated.
+        for (const p of permits) {
+            if (permitStands && p.step === permit.step) continue;
+            details.push({
+                label: "Permit2 allowance",
+                value:
+                    p.amount >= MAX_UINT160
+                        ? "Unlimited"
+                        : amountText(p.amount, tokenInfo(p.token, sources))
+                              .display,
+            });
+            details.push(tokenMovedLine("Allowance token", p.token, sources));
+            details.push({
+                label: "Allowance spender",
+                value: p.spender,
+                address: p.spender,
+            });
+        }
+
         // Keyed on the address, not the symbol: a token absent from the
         // bundled list has no symbol, and gating the line on one dropped it
         // entirely, leaving a Min. received figure with nothing saying what is

tests/balanceRefreshNetworkSwitch.test.js

@@ -97,9 +97,9 @@ test("a refresh that returns after a switch in Settings writes nothing, and the
     );
 });
 
-// The stored record still holds Ethereum Mainnet while the refresh's save reads
-// it, so only this page's own network shows the switch.
-test("a refresh whose save is reading the stored record when the user switches in Settings writes nothing", async () => {
+// The switch is made only once the refresh's save, holding the lock, has
+// written Ethereum Mainnet's balances, and the switch then clears them.
+test("a refresh whose save is reading the stored record when the user switches in Settings leaves none of its balances stored", async () => {
     const page = await bootPopup(unversionedValidProfile());
     expect(page.pageErrors).toEqual([]);
     const { state } = require("../src/shared/state");
@@ -145,7 +145,8 @@ test("a refresh that returns after the background switched the network writes no
 
     const refresh = await holdRefresh(page);
     // The background writes the switch to Sepolia, as its updateState() does
-    // once the user approves a site's request. This page is not told.
+    // once the user approves a site's request. This page is not told of it
+    // yet.
     const record = page.storage.read("autistmask");
     applyChainSwitchFields(record, "sepolia");
     page.storage.write("autistmask", record);

tests/chainSwitchGate.test.js

@@ -446,7 +446,10 @@ describe("switching the network in Settings tells every open tab", () => {
         global.chrome.runtime.sendMessage = (msg) => {
             bg.send(msg, POPUP);
         };
-        await require("../src/shared/state").loadState();
+        const { state, loadState } = require("../src/shared/state");
+        await loadState();
+        // Set by showView(), which is mocked above.
+        state.currentView = "settings";
         require("../src/popup/views/settings").init({
             pageClosed: new AbortController().signal,
         });

tests/e2e/firefox/run.js

@@ -867,6 +867,14 @@ step(
             "the page was not told of the approved switch: " +
                 JSON.stringify(events),
         );
+        // The popup, open all along, shows the new network
+        // (https://git.eeqj.de/sneak/AutistMask/issues/650).
+        await d.switchToWindow(env.popupWindow);
+        await d.waitFor(
+            "the open popup to show the testnet banner",
+            `const banner = document.getElementById("debug-banner");
+             return banner !== null && banner.textContent === "[TESTNET]";`,
+        );
 
         await openNetworkPrompt(env, "switch-restore", sepolia, mainnet);
         await d.click("#btn-approve-network");
@@ -881,6 +889,10 @@ step(
             isDeepStrictEqual(await storedNetwork(env), before),
             "switching back did not restore the mainnet network and endpoints",
         );
+        await d.waitFor(
+            "the open popup to drop the testnet banner",
+            `return document.getElementById("debug-banner") === null;`,
+        );
         await d.switchToWindow(env.dappWindow);
     },
 );

tests/e2e/run.js

@@ -4865,6 +4865,12 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         "the page was not told of the approved switch: " +
             JSON.stringify(events),
     );
+    // The popup, open all along, shows the new network
+    // (https://git.eeqj.de/sneak/AutistMask/issues/650).
+    await env.page.waitForFunction(() => {
+        const banner = document.getElementById("debug-banner");
+        return banner !== null && banner.textContent === "[TESTNET]";
+    });
 
     const restored = await openNetworkPrompt(
         env,
@@ -4886,6 +4892,9 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         isDeepStrictEqual(await storedNetwork(env.page), before),
         "switching back did not restore the mainnet network and endpoints",
     );
+    await env.page.waitForFunction(
+        () => document.getElementById("debug-banner") === null,
+    );
 });
 
 // Switching the network in Settings tells the page too, as an approved site

tests/popupFollowsNetworkSwitch.test.js

@@ -0,0 +1,267 @@
+// An open popup follows a network switch the background saves once the user
+// approves a site's request: it takes the new network from the stored record
+// and draws the screen it is on for it, as a switch in Settings does
+// (https://git.eeqj.de/sneak/AutistMask/issues/650). Driven through the real
+// popup over a stored profile on Ethereum Mainnet. The background's write is
+// the storage stub's set, which the stub reports to the page as the browser
+// does.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+const { makeStorageStub } = require("./support/storageStub");
+const {
+    applyChainSwitchFields,
+    copyChainSwitchFields,
+} = require("../src/shared/chainSwitchFields");
+const { NETWORKS } = require("../src/shared/networks");
+const { STATE_SCHEMA_VERSION } = require("../src/shared/stateSchema");
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+const SEPOLIA_TOKEN = {
+    address: TOKEN_ADDRESS,
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+const MAINNET_TOKEN = {
+    address: "0x6B175474E89094C44Da98b954EedeAC495271d0F",
+    symbol: "DAI",
+    decimals: 18,
+    name: "Dai Stablecoin",
+};
+
+// A profile on Ethereum Mainnet that reopens the popup onto AddressDetail,
+// with DAI tracked there and TST tracked on Sepolia.
+function profileOnAddress() {
+    return unversionedValidProfile({
+        currentView: "address",
+        viewStack: ["main"],
+        selectedWallet: 0,
+        selectedAddress: 0,
+        trackedTokens: [MAINNET_TOKEN],
+        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+    });
+}
+
+// The popup reopened onto it.
+function bootOnAddress() {
+    return bootPopup(profileOnAddress());
+}
+
+// The background saves a switch to `networkId`, as its updateState() does
+// once the user approves a site's request.
+async function backgroundSwitch(page, networkId) {
+    const record = page.storage.read("autistmask");
+    applyChainSwitchFields(record, networkId);
+    await page.storage.local.set({ autistmask: record });
+    await page.settle();
+    await page.settle();
+}
+
+test("the popup open on AddressDetail shows the new network and its balances", async () => {
+    const page = await bootOnAddress();
+    expect(page.pageErrors).toEqual([]);
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).toContain("DAI");
+    expect(page.node("debug-banner")).toBeNull();
+
+    await backgroundSwitch(page, "sepolia");
+
+    const { state } = require("../src/shared/state");
+    expect(state.networkId).toBe("sepolia");
+    expect(state.rpcUrl).toBe(NETWORKS.sepolia.defaultRpcUrl);
+    expect(page.visibleViews()).toEqual(["address"]);
+    const balances = page.node("address-balances").innerHTML;
+    expect(balances).toContain("TST");
+    expect(balances).toContain("SepoliaETH");
+    expect(balances).not.toContain("DAI");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+
+    // Its next refresh runs on Sepolia, and what it fetched is stored.
+    await page.tick();
+    const { refreshBalances } = require("../src/shared/balances");
+    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    const stored = page.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.lastBalanceRefresh).toBeGreaterThan(0);
+});
+
+test("the popup open on Settings shows the new network, and Back draws the screen beneath for it", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+    expect(page.visibleViews()).toEqual(["settings"]);
+
+    await backgroundSwitch(page, "sepolia");
+
+    expect(page.visibleViews()).toEqual(["settings"]);
+    expect(page.value("settings-network")).toBe("sepolia");
+    expect(page.value("settings-rpc")).toBe(NETWORKS.sepolia.defaultRpcUrl);
+    expect(page.node("settings-tracked-tokens").innerHTML).toContain("TST");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+
+    await page.click("btn-settings-back");
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).not.toContain("DAI");
+});
+
+// Neither can be drawn again for the new network: Send cannot be rendered from
+// saved state, and DAI was picked on Ethereum Mainnet, where alone it is
+// tracked. A reopened popup goes to Home in their place.
+test.each([
+    ["Send", (page) => page.click("btn-send")],
+    [
+        "AddressToken for DAI",
+        async (page) => {
+            const { state } = require("../src/shared/state");
+            state.selectedToken = MAINNET_TOKEN.address;
+            require("../src/popup/views/helpers").pushCurrentView();
+            require("../src/popup/views/addressToken").show();
+            await page.settle();
+        },
+    ],
+])("the popup open on %s goes to Home", async (_view, open) => {
+    const page = await bootOnAddress();
+    await open(page);
+    expect(page.visibleViews()).not.toEqual(["address"]);
+
+    await backgroundSwitch(page, "sepolia");
+
+    expect(page.visibleViews()).toEqual(["main"]);
+    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
+});
+
+// The report of the switch's own save names the network the page already has.
+test("a switch in Settings is not taken a second time when its save is reported", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+    const { get, set } = page.storage.local;
+    const reads = get.mock.calls.length;
+    const writes = set.mock.calls.length;
+
+    const select = page.node("settings-network");
+    select.value = "sepolia";
+    for (const fn of select.listeners.change) await fn();
+    await page.settle();
+    await page.settle();
+
+    expect(get).toHaveBeenCalledTimes(reads + 1);
+    expect(set).toHaveBeenCalledTimes(writes + 1);
+    expect(page.text("flash-msg")).toBe("Switched to Sepolia Testnet.");
+});
+
+// The background saves the switch once the popup has read the stored record
+// and before it listens for changes to it, so the browser tells the page
+// nothing of it. Nor is any later write reported here: Chrome reports none
+// that leaves the record as it was, such as the popup's own save at start-up.
+test("a switch saved while the popup opens, before it listens for one, is followed", async () => {
+    const storage = makeStorageStub({ autistmask: profileOnAddress() });
+    storage.onChanged = { addListener: () => {} };
+    const read = storage.local.get.getMockImplementation();
+    storage.local.get.mockImplementationOnce(async (key) => {
+        const loaded = await read(key);
+        const record = storage.read("autistmask");
+        applyChainSwitchFields(record, "sepolia");
+        storage.write("autistmask", record);
+        return loaded;
+    });
+    const page = await bootPopup(undefined, { storage });
+    await page.settle();
+
+    const { state } = require("../src/shared/state");
+    expect(page.pageErrors).toEqual([]);
+    expect(state.networkId).toBe("sepolia");
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).toContain("SepoliaETH");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+});
+
+// While the popup's follow of the background's switch to Sepolia waits for the
+// lock, the user picks Sepolia in Settings and then Ethereum Mainnet again. The
+// last pick is the network stored, and the last one sites are told of.
+test("a switch in Settings made while a follow waits for the lock is not overwritten by it", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+
+    // Another write holds the lock, so every save of the page waits for it.
+    let releaseLock;
+    const lockHeld = navigator.locks.request(
+        "autistmask",
+        () =>
+            new Promise((resolve) => {
+                releaseLock = resolve;
+            }),
+    );
+    await backgroundSwitch(page, "sepolia");
+    const select = page.node("settings-network");
+    const picks = [];
+    for (const networkId of ["sepolia", "mainnet"]) {
+        select.value = networkId;
+        for (const fn of select.listeners.change) picks.push(fn());
+    }
+    releaseLock();
+    await lockHeld;
+    await Promise.all(picks);
+    await page.settle();
+
+    const { state } = require("../src/shared/state");
+    expect(state.networkId).toBe("mainnet");
+    expect(page.storage.read("autistmask").networkId).toBe("mainnet");
+    expect(page.value("settings-network")).toBe("mainnet");
+    const told = globalThis.chrome.runtime.sendMessage.mock.calls
+        .map(([message]) => message)
+        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
+    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
+});
+
+// Such as one a newer build wrote, which this build cannot read. Nothing reads
+// or writes the stored record for it: the popup's next save finds it, as
+// before.
+test("a record that names no network is not followed", async () => {
+    const page = await bootOnAddress();
+    const { get, set } = page.storage.local;
+    const reads = get.mock.calls.length;
+
+    await set({
+        autistmask: {
+            schemaVersion: STATE_SCHEMA_VERSION + 1,
+            wallets: [{ type: "hd", name: "Main", addresses: [] }],
+        },
+    });
+    await page.settle();
+
+    expect(get).toHaveBeenCalledTimes(reads);
+    expect(page.visibleViews()).toEqual(["address"]);
+});
+
+// A record that takes the switch from the switched record ends up as that
+// record, balances the background fetched since included.
+test("copyChainSwitchFields() takes every field applyChainSwitchFields() sets", () => {
+    const before = unversionedValidProfile({
+        trackedTokens: [MAINNET_TOKEN],
+        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+        networkEndpoints: {
+            sepolia: {
+                rpcUrl: "http://127.0.0.1:8545",
+                blockscoutUrl: "http://127.0.0.1:4000/api/v2",
+            },
+        },
+        lastBalanceRefresh: 1,
+        tokenHolderCache: { [MAINNET_TOKEN.address]: 5000 },
+        fraudContracts: ["0x1111111111111111111111111111111111111111"],
+    });
+    const switched = structuredClone(before);
+    applyChainSwitchFields(switched, "sepolia");
+    switched.wallets[0].addresses[0].balance = "2.0";
+
+    const follower = structuredClone(before);
+    copyChainSwitchFields(follower, switched);
+
+    expect(follower).toEqual(switched);
+});

tests/support/popupBoot.js

@@ -311,7 +311,7 @@ async function bootPopup(stored, options) {
     const windowListeners = {};
 
     globalThis.chrome = {
-        storage: { local: storage.local },
+        storage: { local: storage.local, onChanged: storage.onChanged },
         runtime: {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,

tests/support/storageStub.js

@@ -18,7 +18,9 @@
 // a storage stub by hand.
 
 // One storage area: get, set and remove over its own store, cloning both ways.
-function makeArea(store, tick) {
+// `changed` is handed what each set or remove changed, in the shape
+// storage.onChanged reports it.
+function makeArea(store, tick, changed) {
     const get = jest.fn(async (key) => {
         tick();
         if (key === undefined || key === null) return structuredClone(store);
@@ -34,14 +36,25 @@ function makeArea(store, tick) {
 
     const set = jest.fn(async (items) => {
         tick();
+        const changes = {};
         for (const k of Object.keys(items)) {
+            changes[k] = structuredClone({
+                oldValue: store[k],
+                newValue: items[k],
+            });
             store[k] = structuredClone(items[k]);
         }
+        changed(changes);
     });
 
     const remove = jest.fn(async (key) => {
         tick();
-        for (const k of Array.isArray(key) ? key : [key]) delete store[k];
+        const changes = {};
+        for (const k of Array.isArray(key) ? key : [key]) {
+            changes[k] = { oldValue: store[k] };
+            delete store[k];
+        }
+        changed(changes);
     });
 
     return { get, set, remove };
@@ -54,12 +67,22 @@ function makeArea(store, tick) {
 function makeStorageStub(initial, onOp) {
     const store = initial ? structuredClone(initial) : {};
     const tick = onOp || (() => {});
-    const local = makeArea(store, tick);
+    // storage.onChanged: after a set or remove has finished, every listener is
+    // called with what it changed and the area's name, as the browser calls
+    // them for a write by any page or the background.
+    const listeners = [];
+    const announce = (areaName) => (changes) => {
+        Promise.resolve().then(() => {
+            for (const fn of listeners) fn(structuredClone(changes), areaName);
+        });
+    };
+    const local = makeArea(store, tick, announce("local"));
 
     return {
         // Drop this straight in as chrome.storage.
         local,
-        session: makeArea({}, tick),
+        session: makeArea({}, tick, announce("session")),
+        onChanged: { addListener: (fn) => listeners.push(fn) },
         get: local.get,
         set: local.set,
         remove: local.remove,
@@ -71,7 +94,9 @@ function makeStorageStub(initial, onOp) {
                 ? structuredClone(store)
                 : structuredClone(store[key]),
         // Seed or replace a record without going through the module under
-        // test — for standing in as "another page wrote this".
+        // test — for standing in as "another page wrote this". Nothing is
+        // announced to storage.onChanged, so it also stands in for the time
+        // before the browser tells this page of such a write.
         write: (key, value) => {
             store[key] = structuredClone(value);
         },

tests/trackedTokensPerNetwork.test.js

@@ -161,6 +161,7 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
     );
     expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
 
+    await boot.click("btn-settings");
     await chooseNetwork(boot, "mainnet");
     expect(stored().networkId).toBe("mainnet");
     expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);

tests/uniswap.test.js

@@ -1,4 +1,4 @@
-const { AbiCoder, Interface, solidityPacked } = require("ethers");
+const { AbiCoder, Interface, getAddress, solidityPacked } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 
 // A Universal Router on Ethereum Mainnet, chain id 0x1: UniversalRouterV2,
@@ -696,12 +696,8 @@ describe("uniswap decoder", () => {
                 USER_ADDR,
             );
             expect(result.name).toBe("Swap USDT → WETH");
-            expect(detail(result, "Token In").address).toBe(
-                USDT_ADDR.toLowerCase(),
-            );
-            expect(detail(result, "Token Out").address).toBe(
-                WETH_ADDR.toLowerCase(),
-            );
+            expect(detail(result, "Token In").address).toBe(USDT_ADDR);
+            expect(detail(result, "Token Out").address).toBe(WETH_ADDR);
 
             const amount = detail(result, "Amount");
             expect(amount.value).toBe("Up to 2000.0000 USDT");
@@ -735,9 +731,7 @@ describe("uniswap decoder", () => {
         expect(result.name).toBe("Swap ETH → USDC");
         expect(detail(result, "Amount").value).toBe("Up to 0.5000 ETH");
         expect(detail(result, "Moved from the sender")).toBeUndefined();
-        expect(detail(result, "Token Out").address).toBe(
-            USDC_ADDR.toLowerCase(),
-        );
+        expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
         expect(detail(result, "Paid to")).toBeUndefined();
         expect(detail(result, "Min. received").value).toBe("1500.0000 USDC");
     });
@@ -1406,6 +1400,14 @@ describe("uniswap decoder", () => {
             return lines.slice(from + 1, to);
         }
 
+        // The lines of a PERMIT2_PERMIT whose amount does not stand as the
+        // Amount figure, of `amount` of `token` for `spender`.
+        const permitLines = (amount, token, symbol, spender) => [
+            ["Permit2 allowance", amount],
+            ["Allowance token", symbol + " (" + token + ")"],
+            ["Allowance spender", getAddress(spender)],
+        ];
+
         // execute() of these command bytes and inputs, decoded as sent by
         // the user.
         function decodeSteps(commands, inputs) {
@@ -1711,6 +1713,7 @@ describe("uniswap decoder", () => {
                 kind: "a V4 step swapping 400 USDT with a SETTLE of 5,000 USDT by the user, the rest taken to another address,",
                 commands: [0x10],
                 inputs: [V4_SETTLE_5000],
+                permit: [],
             },
             {
                 kind: "a PERMIT2_PERMIT of 1 USDT that the router may let fail, then that V4 step,",
@@ -1719,6 +1722,12 @@ describe("uniswap decoder", () => {
                     encodePermit2(USDT_ADDR, 1000000n, ROUTER_ADDR),
                     V4_SETTLE_5000,
                 ],
+                permit: permitLines(
+                    "1.0000 USDT",
+                    USDT_ADDR,
+                    "USDT",
+                    ROUTER_ADDR,
+                ),
             },
             // The unread SWEEP keeps the permit's amount from standing.
             {
@@ -1735,11 +1744,18 @@ describe("uniswap decoder", () => {
                         1,
                     ),
                 ],
+                permit: permitLines(
+                    "5000.0000 USDT",
+                    USDT_ADDR,
+                    "USDT",
+                    ROUTER_ADDR,
+                ),
             },
-        ])("$kind shows the 5,000 USDT", ({ commands, inputs }) => {
+        ])("$kind shows the 5,000 USDT", ({ commands, inputs, permit }) => {
             const result = decodeSteps(commands, inputs);
             expect(linesBetweenTokens(result)).toEqual([
                 ["Amount", "5000.0000 USDT"],
+                ...permit,
             ]);
         });
 
@@ -2023,19 +2039,24 @@ describe("uniswap decoder", () => {
         });
 
         // Out of that shape the permit caps nothing the Amount line can rely
-        // on, so the line gives the total the steps take, as with no permit.
+        // on, so the line gives the total the steps take, as with no permit,
+        // and each permit gets lines of its own.
         const ONE_USDT_PERMIT = (spender) =>
             encodePermit2(USDT_ADDR, 1000000n, spender);
+        const ONE_USDT_LINES = (spender) =>
+            permitLines("1.0000 USDT", USDT_ADDR, "USDT", spender);
         test.each([
             {
                 kind: "to another spender",
                 commands: [0x0a],
                 permits: [ONE_USDT_PERMIT(OTHER_ADDR)],
+                lines: ONE_USDT_LINES(OTHER_ADDR),
             },
             {
                 kind: "that the router lets fail",
                 commands: [0x8a],
                 permits: [ONE_USDT_PERMIT(ROUTER_ADDR)],
+                lines: ONE_USDT_LINES(ROUTER_ADDR),
             },
             {
                 kind: "followed by a second one",
@@ -2044,10 +2065,14 @@ describe("uniswap decoder", () => {
                     ONE_USDT_PERMIT(ROUTER_ADDR),
                     ONE_USDT_PERMIT(ROUTER_ADDR),
                 ],
+                lines: [
+                    ...ONE_USDT_LINES(ROUTER_ADDR),
+                    ...ONE_USDT_LINES(ROUTER_ADDR),
+                ],
             },
         ])(
             "a split after a PERMIT2_PERMIT $kind shows the total the steps take",
-            ({ commands, permits }) => {
+            ({ commands, permits, lines }) => {
                 const result = decodeSteps(
                     [...commands, 0x00, 0x08],
                     [
@@ -2061,10 +2086,20 @@ describe("uniswap decoder", () => {
                 );
                 expect(linesBetweenTokens(result)).toEqual([
                     ["Amount", "1000.0000 USDT"],
+                    ...lines,
                 ]);
             },
         );
 
+        // The lines of a PERMIT2_PERMIT of 600 USDT to the router whose
+        // amount does not stand.
+        const USDT_600_LINES = permitLines(
+            "600.0000 USDT",
+            USDT_ADDR,
+            "USDT",
+            ROUTER_ADDR,
+        );
+
         // A PERMIT2_PERMIT_BATCH, which this decoder does not read, may raise
         // what the router may take of the permit's token again.
         test("a split after a PERMIT2_PERMIT and a PERMIT2_PERMIT_BATCH shows the total the steps take", () => {
@@ -2096,6 +2131,7 @@ describe("uniswap decoder", () => {
             );
             expect(linesBetweenTokens(result)).toEqual([
                 ["Amount", "10000.0000 USDT"],
+                ...USDT_600_LINES,
             ]);
         });
 
@@ -2141,6 +2177,7 @@ describe("uniswap decoder", () => {
                 );
                 expect(linesBetweenTokens(result)).toEqual([
                     ["Amount", "10000.0000 USDT"],
+                    ...USDT_600_LINES,
                 ]);
             },
         );
@@ -2168,8 +2205,9 @@ describe("uniswap decoder", () => {
         ];
         // What a V3_SWAP_EXACT_OUT takes, at most its amountInMax, counts
         // as a V2_SWAP_EXACT_OUT's does, and the Amount line is a maximum.
-        // The permit of 10,000 USDT stands; the one of 600 USDT does not,
-        // because the step before it took its token.
+        // The permit of 10,000 USDT stands. The one of 600 USDT comes after
+        // the step that set the input side, so it does not stand and gets
+        // lines of its own.
         test.each([
             {
                 kind: "a V3 exact-in of 600 USDT, then a V3_SWAP_EXACT_OUT of at most 400 USDT",
@@ -2201,17 +2239,185 @@ describe("uniswap decoder", () => {
                     V3_600,
                 ],
                 amount: "Up to 10000.0000 USDT",
+                permit: USDT_600_LINES,
             },
         ])(
             "$kind, all paid by the user, shows the total as a maximum",
-            ({ commands, inputs, amount }) => {
+            ({ commands, inputs, amount, permit = [] }) => {
                 const result = decodeSteps(commands, inputs);
                 expect(linesBetweenTokens(result)).toEqual([
                     ["Amount", amount],
+                    ...permit,
                 ]);
             },
         );
 
+        // https://git.eeqj.de/sneak/AutistMask/issues/370 — a PERMIT2_PERMIT
+        // after the step that set the input side named Token In in place of
+        // that step's token, and its amount could stand as the Amount figure.
+        // Only a permit whose amount stands as the Amount figure names Token
+        // In now. Every other, before the swap steps or after them, leaves
+        // Token In and Amount as they read with no permit and gets lines of
+        // its own.
+        describe("a PERMIT2_PERMIT whose amount does not stand as the Amount figure", () => {
+            const DAI_5000 = 5000000000000000000000n;
+            const USDT_5000 = 5000000000n;
+            const MAX_UINT160 = 2n ** 160n - 1n;
+
+            test.each([
+                {
+                    kind: "a V3 exact-in of 600 USDT, then a PERMIT2_PERMIT of 5,000 DAI to the router,",
+                    commands: [0x00, 0x0a],
+                    inputs: [
+                        V3_600,
+                        encodePermit2(DAI_ADDR, DAI_5000, ROUTER_ADDR),
+                    ],
+                    lines: permitLines(
+                        "5000.0000 DAI",
+                        DAI_ADDR,
+                        "DAI",
+                        ROUTER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a V3 exact-in of 600 USDT, then a PERMIT2_PERMIT of unlimited DAI to another spender,",
+                    commands: [0x00, 0x0a],
+                    inputs: [
+                        V3_600,
+                        encodePermit2(DAI_ADDR, MAX_UINT160, OTHER_ADDR),
+                    ],
+                    lines: permitLines(
+                        "Unlimited",
+                        DAI_ADDR,
+                        "DAI",
+                        OTHER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a V3 exact-in of 600 USDT, then a PERMIT2_PERMIT of 600 USDT, the swap's own token, to the router,",
+                    commands: [0x00, 0x0a],
+                    inputs: [
+                        V3_600,
+                        encodePermit2(USDT_ADDR, USDT_600, ROUTER_ADDR),
+                    ],
+                    lines: USDT_600_LINES,
+                },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 USDT to another spender, then a V3 exact-in of 600 USDT,",
+                    commands: [0x0a, 0x00],
+                    inputs: [
+                        encodePermit2(USDT_ADDR, USDT_5000, OTHER_ADDR),
+                        V3_600,
+                    ],
+                    lines: permitLines(
+                        "5000.0000 USDT",
+                        USDT_ADDR,
+                        "USDT",
+                        OTHER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 USDT to the router that the router may let fail, then a V3 exact-in of 600 USDT,",
+                    commands: [0x8a, 0x00],
+                    inputs: [
+                        encodePermit2(USDT_ADDR, USDT_5000, ROUTER_ADDR),
+                        V3_600,
+                    ],
+                    lines: permitLines(
+                        "5000.0000 USDT",
+                        USDT_ADDR,
+                        "USDT",
+                        ROUTER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 DAI to another spender, then a V3 exact-in of 600 USDT,",
+                    commands: [0x0a, 0x00],
+                    inputs: [
+                        encodePermit2(DAI_ADDR, DAI_5000, OTHER_ADDR),
+                        V3_600,
+                    ],
+                    lines: permitLines(
+                        "5000.0000 DAI",
+                        DAI_ADDR,
+                        "DAI",
+                        OTHER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 DAI to the router, a V3 exact-in of 600 USDT, then a PERMIT2_PERMIT of 600 USDT to the router,",
+                    commands: [0x0a, 0x00, 0x0a],
+                    inputs: [
+                        encodePermit2(DAI_ADDR, DAI_5000, ROUTER_ADDR),
+                        V3_600,
+                        encodePermit2(USDT_ADDR, USDT_600, ROUTER_ADDR),
+                    ],
+                    lines: [
+                        ...permitLines(
+                            "5000.0000 DAI",
+                            DAI_ADDR,
+                            "DAI",
+                            ROUTER_ADDR,
+                        ),
+                        ...USDT_600_LINES,
+                    ],
+                },
+            ])(
+                "$kind shows the swap's 600 USDT and each permit's own lines",
+                ({ commands, inputs, lines }) => {
+                    const result = decodeSteps(commands, inputs);
+                    expect(result.name).toBe("Swap USDT → USDC");
+                    // The swap step names Token In, its address checksummed,
+                    // as on a permit's Allowance token line.
+                    expect(detail(result, "Token In").value).toBe(
+                        "USDT (" + USDT_ADDR + ")",
+                    );
+                    expect(linesBetweenTokens(result)).toEqual([
+                        ["Amount", "600.0000 USDT"],
+                        ...lines,
+                    ]);
+                    expect(detail(result, "Amount").rawValue).toBe("600.0000");
+                },
+            );
+
+            // With two permits neither amount stands, so the Amount line
+            // gives the total the steps take of USDT, the 400 DAI the last
+            // step takes gets lines of its own, and so does each permit.
+            test("a PERMIT2_PERMIT of USDT, a V3 exact-in of 600 USDT, a PERMIT2_PERMIT of DAI and a V2 exact-in of 400 DAI shows both tokens' amounts and each permit's own lines", () => {
+                const result = decodeSteps(
+                    [0x0a, 0x00, 0x0a, 0x08],
+                    [
+                        encodePermit2(USDT_ADDR, USDT_5000, ROUTER_ADDR),
+                        V3_600,
+                        encodePermit2(DAI_ADDR, DAI_400, ROUTER_ADDR),
+                        encodeV2SwapExactIn(USER_ADDR, DAI_400, 390000000n, [
+                            DAI_ADDR,
+                            USDC_ADDR,
+                        ]),
+                    ],
+                );
+                expect(result.name).toBe("Swap USDT → USDC");
+                expect(linesBetweenTokens(result)).toEqual([
+                    ["Amount", "600.0000 USDT"],
+                    ["Moved from the sender", "400.0000 DAI"],
+                    ["Token moved", "DAI (" + DAI_ADDR + ")"],
+                    ["Moved to", "The swap step that spends it"],
+                    ...permitLines(
+                        "5000.0000 USDT",
+                        USDT_ADDR,
+                        "USDT",
+                        ROUTER_ADDR,
+                    ),
+                    ...permitLines(
+                        "400.0000 DAI",
+                        DAI_ADDR,
+                        "DAI",
+                        ROUTER_ADDR,
+                    ),
+                ]);
+            });
+        });
+
         // A V3_SWAP_EXACT_OUT whose path is shorter than one token cannot be
         // read. It may pay any address and take from the sender, so it
         // leaves no Amount figure.
@@ -2257,7 +2463,7 @@ describe("uniswap decoder", () => {
         // A V3 exact-out of 1,500 USDC for at most 0.5 WETH spends WETH, not
         // SPK. After it, a PERMIT2_PERMIT of 1 WETH and a V3 exact-in of 0.5
         // WETH: the permit's amount does not stand, because the step before
-        // it also takes WETH.
+        // it also takes WETH, so the permit gets lines of its own.
         test("a V3_SWAP_EXACT_OUT whose path has bytes after its last hop, then a PERMIT2_PERMIT and a V3 exact-in, shows no Amount figure", () => {
             const path = pathEndingIn([USDC_ADDR, WETH_ADDR], SPK_ADDR);
             const result = decodeSteps(
@@ -2273,6 +2479,7 @@ describe("uniswap decoder", () => {
             );
             expect(linesBetweenTokens(result)).toEqual([
                 ["Moved from the sender", UNDECODED],
+                ...permitLines("1.0000 WETH", WETH_ADDR, "WETH", ROUTER_ADDR),
             ]);
             expect(detail(result, "Paid to").value).toBe(UNDECODED);
         });
@@ -2443,7 +2650,11 @@ describe("uniswap decoder", () => {
                     V4_EXACT_OUT_600,
                     V2_EXACT_OUT_400,
                 ],
-                lines: [...UNKNOWN_USDT, ...UP_TO_400_USDT],
+                lines: [
+                    ...UNKNOWN_USDT,
+                    ...UP_TO_400_USDT,
+                    ...ONE_USDT_LINES(OTHER_ADDR),
+                ],
             },
             {
                 kind: "a V4 step whose swap action cannot be read, with a SETTLE of WETH by the user, then a V2 exact-out of at most 400 USDT",
@@ -3069,9 +3280,7 @@ describe("uniswap decoder", () => {
         );
         const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Uniswap Swap");
-        expect(detail(result, "Token In").address).toBe(
-            USDT_ADDR.toLowerCase(),
-        );
+        expect(detail(result, "Token In").address).toBe(USDT_ADDR);
         expect(detail(result, "Amount").value).toBe("1000.0000 USDT");
         expect(detail(result, "Token Out").value).toBe(
             "Unknown (not named in the calldata)",
@@ -3129,9 +3338,7 @@ describe("uniswap decoder", () => {
             "Unknown (not named in the calldata)",
         );
         expect(detail(result, "Amount")).toBeUndefined();
-        expect(detail(result, "Token Out").address).toBe(
-            USDT_ADDR.toLowerCase(),
-        );
+        expect(detail(result, "Token Out").address).toBe(USDT_ADDR);
         expect(detail(result, "Min. received").value).toBe("990.0000 USDT");
     });
 

tests/uniswapRecipient.test.js

@@ -2809,7 +2809,7 @@ describe("the allow-revert flag", () => {
             mark: " (allowed to fail)",
         },
     ])(
-        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap reads as without the flag",
+        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap's lines read as without the flag",
         ({ address, mark }) => {
             const steps = [
                 permit2Permit(USDT, USDT_2000),
@@ -2824,9 +2824,24 @@ describe("the allow-revert flag", () => {
             expect(detail(withFlag, "Steps").value).toBe(
                 "Permit2 Permit" + mark + " → V3 Swap (Exact In)",
             );
-            const withoutSteps = (r) =>
-                r.details.filter((d) => d.label !== "Steps");
-            expect(withoutSteps(withFlag)).toEqual(withoutSteps(plain));
+            // The permit names the router at ROUTER as its spender, so its
+            // amount stands as the Amount figure only there, and only without
+            // the flag. With the flag it stands on no router and gets lines
+            // of its own, and the swap step names Token In: the same token,
+            // its address written the same way.
+            const permitLines = [
+                "Permit2 allowance",
+                "Allowance token",
+                "Allowance spender",
+            ];
+            const swapLines = (r) =>
+                r.details.filter(
+                    (d) => !["Steps", ...permitLines].includes(d.label),
+                );
+            expect(swapLines(withFlag)).toEqual(swapLines(plain));
+            expect(
+                labels(withFlag).filter((l) => permitLines.includes(l)),
+            ).toEqual(permitLines);
             expect(detail(withFlag, "Min. received").value).toBe("1.0000 WETH");
         },
     );