fix: merge state per field instead of overwriting the whole blob (closes #304)

saveState() is now a read-modify-write that merges only the fields this page
changed, diffed against a deep-cloned per-page baseline. wallets, allowedSites,
deniedSites and networkEndpoints merge structurally by identity, so membership
comes from fresh storage except for this page's own adds and deletes.

Fixes a second extension page silently deleting a wallet, the background balance
refresh clobbering a concurrent add or resurrecting a delete, and a stale page
resurrecting a revoked site permission.

Colliding wallet identities keep both records and log rather than silently
dropping an encryptedSecret. Concurrent writers of the same leaf remain
last-writer-wins by design.

README.md

@@ -805,7 +805,9 @@ for the views listed in `RESTORABLE_VIEWS` (`src/popup/restorableViews.js`).
 Every other screen falls back to Home. The screens that display a secret —
 ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
-of it.
+of it. So are the two that destroy one, DeleteWallet and
+DeleteWalletLostPassword: a popup reopened by accident must not land on a screen
+whose button erases key material.
 
 A reopened popup renders the wallet list and the one screen it restores onto,
 and nothing else, so every screen on the stack behind that one is still the
@@ -828,7 +830,10 @@ exit from that screen rather than only on its "Back" button, so nothing secret
 survives in a hidden view once the user has navigated away by any route. That
 covers the revealed private key and recovery phrase, the recovery phrase,
 private key or extended private key entered on AddWallet, and the password typed
-on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
+on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign. DeleteWalletLostPassword
+registers one as well, for the neighbouring reason rather than that one: a
+wallet name is not a secret, but a typed confirmation left standing in a hidden
+view would leave a wallet one click from deletion.
 
 #### Welcome (`welcome`)
 
@@ -889,7 +894,13 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
         - **From xprv**: instruction text and a masked extended private key
           input
     - Password + confirm password inputs, with a hint line whose wording depends
-      on the selected tab
+      on the selected tab. Every wording says that the password cannot be
+      recovered or reset and names what the only backup of the wallet is — the
+      recovery phrase, the private key or the extended private key, according to
+      the tab. This is the only warning the user gets before the wallet exists;
+      without it, the lost-password route on DeleteWallet is the first they
+      would hear of it. The hint line reserves its height, so switching tabs
+      cannot move the password fields under the pointer.
     - "Import" button
 - **Transitions**:
     - "Import" with a valid entry and a matching password of at least 12
@@ -1244,6 +1255,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
     - Error line
     - Password input
     - "Confirm Delete" button
+    - An underlined "I have lost my password" control
 - **Transitions**:
     - "Confirm Delete" (correct password, other wallets remain) → deletes the
       wallet and its site permissions, then → **Settings** with a "Wallet
@@ -1253,10 +1265,54 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
     - Either way, the active address moves only if it belonged to the deleted
       wallet, and `AUTISTMASK_ACTIVE_CHANGED` is broadcast when it does
       (`src/shared/walletDelete.js`)
-    - "Confirm Delete" (wrong password) → "Wrong password." on the error line,
-      nothing deleted
+    - "Confirm Delete" (wrong password) → "That password is incorrect. Please
+      try again." on the error line, nothing deleted
+    - "I have lost my password" → **DeleteWalletLostPassword**
     - "Back" → previous screen (Settings)
 
+#### DeleteWalletLostPassword (`delete-wallet-lost-password`)
+
+- **When**: User tapped "I have lost my password" on DeleteWallet.
+- **Why it exists**: without it, a user who has forgotten the password but still
+  holds the recovery phrase has no route back into the product at all. Deletion
+  was password-gated, and importing the phrase again is refused as a duplicate
+  xpub by `findWalletByXpub()` while the wallet is still stored, so the only
+  escape was clearing extension storage through browser internals — which takes
+  every other wallet with it.
+- **Elements**:
+    - "Back" button, "Delete Wallet Without a Password" heading
+    - A statement that the password cannot be recovered or reset, so the wallet
+      cannot be unlocked again, and that no password is needed to delete it
+    - What deletion does and does not do: it erases the copy of the key stored
+      on this device; nothing on chain changes and no money is moved
+    - The route back — adding the wallet again with the recovery phrase and a
+      new password — and, in bold, that without that phrase written down the
+      deletion loses everything the wallet holds, forever
+    - That the other wallets are not touched
+    - The wallet's name, and a text input asking for it to be typed back
+    - Error line
+    - "Delete This Wallet Forever" button
+- **Transitions**:
+    - "Delete This Wallet Forever" (name typed correctly) → the same two
+      outcomes as "Confirm Delete" above, through the same `finishDelete()`, so
+      the selection repair, permission cleanup and `AUTISTMASK_ACTIVE_CHANGED`
+      broadcast are identical on both routes
+    - "Delete This Wallet Forever" (name does not match) → "That is not the name
+      of this wallet. Type <name> to confirm." on the error line, nothing
+      deleted
+    - "Back" → **DeleteWallet**, re-entered through its `show()` so the wallet
+      selection comes back with it. The two delete screens are siblings rather
+      than parent and child: nothing is pushed on the way here, so both have
+      Settings as their Back target.
+- **Deliberately not password-gated.** A password in front of _discarding_ a
+  secret protects nobody: an attacker at the popup who wants the wallet gone can
+  uninstall the extension, so the only person such a gate stops is the owner who
+  forgot it. The typed name is a check that the user knows which wallet they are
+  on, not a secret, so it is matched with surrounding spaces and letter case
+  ignored.
+- Not in `RESTORABLE_VIEWS`, alongside `delete-wallet-confirm`: a popup reopened
+  by accident must not land on a screen whose button erases key material.
+
 #### DeleteAddress (`delete-address-confirm`)
 
 - **When**: User tapped the `[x]` next to an address on Home. Offered only on HD
@@ -1273,13 +1329,13 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
       refused: "+" derives the next unused index (`nextIndex` is a high-water
       mark), and re-importing the wallet's key material is rejected as a
       duplicate by `findWalletByXpub` while the wallet is still present. What
-      works is deleting the whole wallet in Settings — password-gated, and it
-      destroys the stored secret — then importing again, whereupon
-      `scanForAddresses()` rediscovers the address **only if it has on-chain
-      activity**. An address that was never used is not found by that scan. The
-      text is written by `recoveryPathText()` rather than sitting in
-      `index.html`, so it can name the wallet's own kind of key material: an
-      xprv wallet has no recovery phrase to re-import.
+      works is deleting the whole wallet in Settings — which destroys the stored
+      secret — then importing again, whereupon `scanForAddresses()` rediscovers
+      the address **only if it has on-chain activity**. An address that was
+      never used is not found by that scan. The text is written by
+      `recoveryPathText()` rather than sitting in `index.html`, so it can name
+      the wallet's own kind of key material: an xprv wallet has no recovery
+      phrase to re-import.
     - A warning when the address holds anything, ETH or any tracked ERC-20,
       followed by the holdings themselves via `balanceLinesForAddress()` and the
       USD total via `formatAddressTotal()` (see

TODO.md

@@ -44,6 +44,58 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-20: A second extension page can no longer silently delete a wallet
+  ([#304](https://git.eeqj.de/sneak/AutistMask/issues/304)). `saveState()` wrote
+  the entire state blob, and every extension page — the toolbar popup, a dApp
+  approval window, `backgroundRefresh()` — holds its own in-memory `state`,
+  loaded once, with `showView()` saving on every navigation; a second page that
+  saved after a first had written something new overwrote it, no attacker or
+  unusual input required. `saveState()` is now a read-modify-write: it re-reads
+  storage, diffs the persisted fields against a deep-cloned `baseline` snapshot
+  taken at the last `loadState()`/`saveState()` on that page, and writes only
+  the fields that actually changed — everything else is carried forward from
+  storage in its loaded-and-normalized shape (`normalizePersisted()`, shared
+  with `loadState()`), so a legacy or malformed record a load has always
+  self-healed in memory keeps getting written back even on a save that touched
+  something else entirely. `showView()` fires `saveState()` on every navigation
+  without awaiting it, so two saves from the same page can be in flight at once;
+  a FIFO queue serializes them rather than letting a slow one finish after a
+  later one and re-derive a stale answer. Deliberately not done: the live
+  `state` of a field this page does not own is not rehydrated from what another
+  page wrote, only the persisted record is — adopting a concurrently-written
+  value into `state` reintroduced the same clobber one page later, caught by
+  `tests/txStatus.test.js` red. Two writers of the same field still resolve
+  last-writer-wins, documented at the merge point. `tests/stateMerge.test.js`
+  covers the two-page save and the approval-window reproduction from the issue —
+  add a wallet in one page, force a save from a second page loaded before it,
+  both wallets survive — each demonstrated failing against the unfixed full-blob
+  write.
+- 2026-08-20: A forgotten password no longer wedges the wallet
+  ([#312](https://git.eeqj.de/sneak/AutistMask/issues/312)). Deleting a wallet
+  was password-gated and importing its recovery phrase again was refused as a
+  duplicate xpub, so a user who had the phrase but not the password could
+  neither leave nor come back: the only way out was clearing extension storage
+  through browser internals, which takes every other wallet with it.
+  DeleteWallet now offers "I have lost my password", a screen that destroys the
+  wallet after the user types its name back — no password, because requiring one
+  to _discard_ a secret protects nobody. An attacker at the popup who wants the
+  wallet gone can uninstall the extension; the only person such a gate stopped
+  was the owner who forgot it. That was chosen over allowing a duplicate xpub to
+  re-encrypt in place: re-import would have had to be built three times over
+  (`hd` and `xprv` by xpub, `key` by address), would make the user retype the
+  recovery phrase into a live popup to change a password, and reaches no state
+  that delete-then-import does not already reach through `scanForAddresses()`.
+  Both routes share one `finishDelete()`, so the selection repair, the
+  site-permission cleanup and the `AUTISTMASK_ACTIVE_CHANGED` broadcast cannot
+  diverge between them, and the new screen is excluded from `RESTORABLE_VIEWS` —
+  a popup reopened by accident must not land on a button that erases key
+  material. AddWallet's password hint now says, per import mode, that the
+  password cannot be recovered or reset and what the only backup is; the hint
+  line reserves its height so switching tabs cannot move the password fields.
+  The test drives the real view against a `chrome.storage.local` stub that
+  structured-clones on both `set` and `get` and asserts against the read-back,
+  so it fails on the deletion of `saveState()` and not only on an in-memory
+  splice.
 - 2026-08-20: `make build` can no longer hand back a debug build, and
   `script/verify-build` can no longer be satisfied by bytes the build did not
   produce ([#309](https://git.eeqj.de/sneak/AutistMask/issues/309)). The

src/popup/index.html

@@ -153,12 +153,28 @@
                 <!-- Shared password fields -->
                 <div class="mb-2" id="add-wallet-password-section">
                     <label class="block mb-1">Choose a password</label>
+                    <!-- The hint is swapped in place when the import tab
+                         changes, and it sits directly above the password
+                         fields, so a wording that wraps to a different
+                         number of lines would move them under the pointer.
+                         Two things stop that: the three wordings in
+                         PASSWORD_HINTS are kept within a couple of
+                         characters of each other in length, and this floor
+                         matches what each of them needs. All three measure
+                         48px -- 3 lines at the 16px line height, at the
+                         368px width this box has in the 396px popup body.
+                         Do not raise it: the reserve is unused height on
+                         every tab, and at 6rem it pushed
+                         #btn-add-wallet-confirm to bottom=628px in a 600px
+                         viewport, below the fold. -->
                     <p
-                        class="text-xs text-muted mb-1"
+                        class="text-xs text-muted mb-1 min-h-[3rem]"
                         id="add-wallet-password-hint"
                     >
                         This password encrypts your recovery phrase on this
-                        device. You will need it to send funds.
+                        device. You will need it to send funds. It cannot be
+                        recovered or reset, so keep your recovery phrase written
+                        down: it is the only backup of this wallet.
                     </p>
                     <input
                         type="password"
@@ -1140,6 +1156,71 @@
                 >
                     Confirm Delete
                 </button>
+                <p class="text-xs mt-3">
+                    <span
+                        id="btn-delete-wallet-lost-password"
+                        class="underline decoration-dashed cursor-pointer"
+                        >I have lost my password</span
+                    >
+                </p>
+            </div>
+
+            <!-- ============ DELETE WALLET WITHOUT THE PASSWORD ============ -->
+            <div id="view-delete-wallet-lost-password" class="view hidden">
+                <button
+                    id="btn-delete-wallet-lost-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-3">Delete Wallet Without a Password</h2>
+                <p class="text-xs mb-2">
+                    Your password cannot be recovered or reset, so there is no
+                    way to unlock
+                    <strong id="delete-wallet-lost-name"></strong> again. You
+                    can still delete it, and no password is needed to do that.
+                </p>
+                <p class="text-xs mb-2">
+                    Deleting it erases the copy of its key that is stored on
+                    this device. Nothing on the blockchain changes, and the
+                    money at its addresses is not moved or destroyed.
+                </p>
+                <p class="text-xs mb-2">
+                    If you have the recovery phrase for this wallet written
+                    down, add the wallet again afterwards with a new password
+                    and you will have it back.
+                    <strong
+                        >If you do not have it written down, deleting this
+                        wallet means losing everything it holds,
+                        forever.</strong
+                    >
+                </p>
+                <p class="text-xs mb-3">Your other wallets are not touched.</p>
+                <p class="text-xs mb-1">
+                    To confirm, type the name of the wallet (<strong
+                        id="delete-wallet-lost-name-echo"
+                    ></strong
+                    >) below.
+                </p>
+                <div class="mb-2">
+                    <input
+                        type="text"
+                        id="delete-wallet-lost-name-input"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        placeholder="Type the wallet name"
+                    />
+                </div>
+                <div
+                    id="delete-wallet-lost-flash"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
+                ></div>
+                <button
+                    id="btn-delete-wallet-lost-confirm"
+                    class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                >
+                    Delete This Wallet Forever
+                </button>
             </div>
 
             <!-- ============ DELETE ADDRESS CONFIRM ============ -->

src/popup/restorableViews.js

@@ -10,6 +10,11 @@
 // prompt in front of it, on a popup the user may have reopened by accident.
 // That is why "export-privkey" and "show-phrase" are absent.
 //
+// Nor may a view whose button destroys a wallet be listed, for the mirror
+// reason: a popup reopened by accident must not land on the screen that
+// erases key material. That is why "delete-wallet-confirm" and
+// "delete-wallet-lost-password" are absent.
+//
 // Kept in its own module, with no dependencies, so tests can assert the
 // exclusion directly rather than trusting a reading of the popup entry
 // point, which cannot be required outside a browser.

src/popup/views/addWallet.js

@@ -42,12 +42,24 @@ let currentMode = "mnemonic";
 
 const MODES = ["mnemonic", "privkey", "xprv"];
 
+// Each hint names what this import mode's own backup is, because a key
+// wallet and an xprv wallet have no recovery phrase to point the user at.
+// All three say the same thing about the password: it is gone for good if
+// it is forgotten. That sentence is the only warning the user gets before
+// the wallet exists, and without it the lost-password route in
+// views/deleteWallet.js is the first they hear of it.
+//
+// Keep the three within a couple of characters of each other in length.
+// The hint sits directly above the password fields and the tabs swap it in
+// place, so a wording that wraps to a different number of lines would move
+// those fields under the pointer; the reserved height on
+// #add-wallet-password-hint is the other half of that guarantee.
 const PASSWORD_HINTS = {
     mnemonic:
-        "This password encrypts your recovery phrase on this device. You will need it to send funds.",
+        "This password encrypts your recovery phrase on this device. You will need it to send funds. It cannot be recovered or reset, so keep your recovery phrase written down: it is the only backup of this wallet.",
     privkey:
-        "This password encrypts your private key on this device. You will need it to send funds.",
-    xprv: "This password encrypts your key on this device. You will need it to send funds.",
+        "This password encrypts your private key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your private key saved somewhere safe: it is the only backup of this wallet.",
+    xprv: "This password encrypts your key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your extended private key saved somewhere safe: it is the only backup of this wallet.",
 };
 
 function switchMode(mode) {

src/popup/views/deleteAddress.js

@@ -45,8 +45,8 @@ function setFlash(msg) {
 // wallet.nextIndex is a high-water mark and is deliberately not rewound; and
 // re-importing this wallet's key material is refused as a duplicate by
 // findWalletByXpub() for as long as the wallet is here. What remains is to
-// delete the whole wallet in Settings — which asks for the password and
-// destroys the stored secret — and import again, after which
+// delete the whole wallet in Settings — which destroys the stored secret,
+// with or without the password — and import again, after which
 // scanForAddresses() rediscovers the address only if it has on-chain
 // activity. An address that was never used is not found by that scan, and
 // the copy must not imply otherwise.
@@ -63,8 +63,7 @@ function recoveryPathText(wallet) {
         "importing this " +
         secret +
         " again is refused while this wallet is still here. The way back is " +
-        "to delete the whole wallet in Settings, which asks for your " +
-        "password and destroys the stored " +
+        "to delete the whole wallet in Settings, which destroys the stored " +
         secret +
         ", and then import that " +
         secret +

src/popup/views/deleteWallet.js

@@ -14,8 +14,29 @@ const {
 } = require("../../shared/walletDelete");
 
 let deleteWalletIndex = null;
+let lostPasswordIndex = null;
 let ctx = null;
 
+// The name shown for a wallet, and on the lost-password screen the string
+// the user has to type back. One function so the two cannot disagree: a
+// confirmation that asks for a name other than the one on screen is
+// unusable.
+function displayName(walletIdx) {
+    const wallet = state.wallets[walletIdx];
+    return (wallet && wallet.name) || "Wallet " + (walletIdx + 1);
+}
+
+// What the typed confirmation and the wallet name are compared as. HTML
+// collapses runs of whitespace when it renders the name, so a wallet named
+// "My  Wallet" with two spaces DISPLAYS as "My Wallet": the user cannot
+// see the second space and cannot type a string that matches the stored
+// name. Comparing collapsed on both sides is what keeps the confirmation
+// satisfiable, on the one screen whose whole purpose is unwedging a user
+// who is already stuck. Case and surrounding space go the same way.
+function confirmKey(name) {
+    return name.trim().replace(/\s+/g, " ").toLowerCase();
+}
+
 // Drop the password from the DOM and the wallet selection from the
 // closure. Registered as the view-leave handler as well as run on entry,
 // so the typed password does not sit in the hidden view after the user
@@ -27,19 +48,89 @@ function clear() {
     $("delete-wallet-flash").style.visibility = "hidden";
 }
 
+// The lost-password screen holds no secret — a wallet name is not one —
+// but it is wiped on leave for the neighbouring reason: a typed
+// confirmation left standing in a hidden view is one click away from
+// destroying a wallet the user has since navigated off. The button is
+// re-enabled here too, so a screen left mid-delete is usable on re-entry.
+function clearLostPassword() {
+    lostPasswordIndex = null;
+    $("delete-wallet-lost-name-input").value = "";
+    $("delete-wallet-lost-flash").textContent = "";
+    $("delete-wallet-lost-flash").style.visibility = "hidden";
+    const btn = $("btn-delete-wallet-lost-confirm");
+    btn.disabled = false;
+    btn.classList.remove("text-muted");
+}
+
 function show(walletIdx) {
     clear();
     deleteWalletIndex = walletIdx;
-    const wallet = state.wallets[walletIdx];
-    $("delete-wallet-name").textContent =
-        wallet.name || "Wallet " + (walletIdx + 1);
+    $("delete-wallet-name").textContent = displayName(walletIdx);
     showView("delete-wallet-confirm");
 }
 
+// The two delete screens are siblings, not parent and child: nothing is
+// pushed on the way here, and Back goes to show() rather than goBack().
+// Both then have the same Back target — Settings, the screen that pushed
+// delete-wallet-confirm — and re-entering through show() hands the confirm
+// screen its wallet selection back, which a bare goBack() onto a view
+// whose leave hook has already nulled that selection would not.
+function showLostPassword() {
+    const walletIdx = deleteWalletIndex;
+    if (walletIdx === null) {
+        goBack();
+        return;
+    }
+    const name = displayName(walletIdx);
+    clearLostPassword();
+    $("delete-wallet-lost-name").textContent = name;
+    $("delete-wallet-lost-name-echo").textContent = name;
+    // showView() runs the leave hook of delete-wallet-confirm, which nulls
+    // deleteWalletIndex, so this screen's own selection is recorded after
+    // it and not before.
+    showView("delete-wallet-lost-password");
+    lostPasswordIndex = walletIdx;
+}
+
+// Remove the wallet and put the user somewhere sensible. Shared by both
+// routes onto this screen, so the selection repair, the site-permission
+// cleanup and the accountsChanged broadcast cannot drift apart between
+// them.
+async function finishDelete(walletIdx) {
+    const { activeAddressChanged } = removeWalletFromState(state, walletIdx);
+
+    deleteWalletIndex = null;
+    lostPasswordIndex = null;
+
+    if (!state.hasWallet) {
+        clearViewStack();
+        await saveState();
+        // Save before broadcasting: the background reads the active
+        // address back out of storage to build accountsChanged.
+        if (activeAddressChanged) broadcastActiveChanged();
+        showView("welcome");
+        return;
+    }
+
+    await saveState();
+    if (activeAddressChanged) broadcastActiveChanged();
+    // Reset stack to [main] so Settings back goes home.
+    // Use require() lazily to avoid circular dependency
+    // (settings.js requires deleteWallet.js).
+    clearViewStack();
+    state.viewStack.push("main");
+    ctx.renderWalletList();
+    const settings = require("./settings");
+    settings.show();
+    showFlash("Wallet deleted.");
+}
+
 function init(_ctx) {
     ctx = _ctx;
 
     onViewLeave("delete-wallet-confirm", clear);
+    onViewLeave("delete-wallet-lost-password", clearLostPassword);
 
     // No wipe here: goBack() routes through showView(), which runs the
     // leave hook.
@@ -47,6 +138,60 @@ function init(_ctx) {
         goBack();
     });
 
+    // The escape hatch, and deliberately not gated on anything a user who
+    // has lost the password cannot produce. A password in front of
+    // DISCARDING a secret protects nobody: an attacker at the popup who
+    // wants the wallet gone can uninstall the extension, so the only
+    // person such a gate stops is the owner who forgot it — and before
+    // this route existed that owner could neither delete the wallet nor
+    // import its recovery phrase again, because AddWallet refuses the xpub
+    // as a duplicate while the wallet is still stored.
+    $("btn-delete-wallet-lost-password").addEventListener("click", () => {
+        showLostPassword();
+    });
+
+    $("btn-delete-wallet-lost-back").addEventListener("click", () => {
+        const walletIdx = lostPasswordIndex;
+        if (walletIdx === null) {
+            goBack();
+            return;
+        }
+        show(walletIdx);
+    });
+
+    $("btn-delete-wallet-lost-confirm").addEventListener("click", async () => {
+        if (lostPasswordIndex === null) {
+            $("delete-wallet-lost-flash").textContent =
+                "No wallet selected for deletion.";
+            $("delete-wallet-lost-flash").style.visibility = "visible";
+            return;
+        }
+
+        // Case, surrounding spaces and repeated inner spaces are not part
+        // of the confirmation; see confirmKey(). This asks whether the
+        // user knows which wallet they are on; it is not a secret, and
+        // refusing "wallet 2" for "Wallet 2" would only teach the user to
+        // distrust the control.
+        const typed = $("delete-wallet-lost-name-input").value;
+        const expected = displayName(lostPasswordIndex);
+        if (confirmKey(typed) !== confirmKey(expected)) {
+            $("delete-wallet-lost-flash").textContent =
+                "That is not the name of this wallet. Type " +
+                expected +
+                " to confirm.";
+            $("delete-wallet-lost-flash").style.visibility = "visible";
+            return;
+        }
+
+        const btn = $("btn-delete-wallet-lost-confirm");
+        btn.disabled = true;
+        btn.classList.add("text-muted");
+
+        // finishDelete() navigates, and the leave hook re-enables the
+        // button and wipes the typed name on the way out.
+        await finishDelete(lostPasswordIndex);
+    });
+
     $("btn-delete-wallet-confirm").addEventListener("click", async () => {
         const pw = $("delete-wallet-password").value;
         if (!pw) {
@@ -82,34 +227,7 @@ function init(_ctx) {
             return;
         }
 
-        // Remove the wallet and repair selection, permissions and hasWallet
-        const { activeAddressChanged } = removeWalletFromState(
-            state,
-            walletIdx,
-        );
-
-        deleteWalletIndex = null;
-
-        if (!state.hasWallet) {
-            clearViewStack();
-            await saveState();
-            // Save before broadcasting: the background reads the active
-            // address back out of storage to build accountsChanged.
-            if (activeAddressChanged) broadcastActiveChanged();
-            showView("welcome");
-        } else {
-            await saveState();
-            if (activeAddressChanged) broadcastActiveChanged();
-            // Reset stack to [main] so Settings back goes home.
-            // Use require() lazily to avoid circular dependency
-            // (settings.js requires deleteWallet.js).
-            clearViewStack();
-            state.viewStack.push("main");
-            ctx.renderWalletList();
-            const settings = require("./settings");
-            settings.show();
-            showFlash("Wallet deleted.");
-        }
+        await finishDelete(walletIdx);
     });
 }
 

src/popup/views/helpers.js

@@ -36,6 +36,7 @@ const VIEWS = [
     "add-token",
     "settings",
     "delete-wallet-confirm",
+    "delete-wallet-lost-password",
     "delete-address-confirm",
     "settings-addtoken",
     "transaction",

src/shared/state.js

@@ -6,6 +6,7 @@ const { networkById } = require("./networks");
 const { RESTORABLE_VIEWS } = require("../popup/restorableViews");
 
 const { storageGet, storageSet } = require("./browserApi");
+const { log } = require("./log");
 
 const DEFAULT_STATE = {
     hasWallet: false,
@@ -88,135 +89,529 @@ function currentNetwork() {
     return networkById(state.networkId);
 }
 
-async function saveState() {
-    const persisted = {
-        hasWallet: state.hasWallet,
-        wallets: state.wallets,
-        trackedTokens: state.trackedTokens,
-        networkId: state.networkId,
-        rpcUrl: state.rpcUrl,
-        blockscoutUrl: state.blockscoutUrl,
-        networkEndpoints: state.networkEndpoints,
-        lastBalanceRefresh: state.lastBalanceRefresh,
-        activeAddress: state.activeAddress,
-        allowedSites: state.allowedSites,
-        deniedSites: state.deniedSites,
-        rememberSiteChoice: state.rememberSiteChoice,
-        showZeroBalanceTokens: state.showZeroBalanceTokens,
-        hideSpoofedSymbols: state.hideSpoofedSymbols,
-        hideLowHolderTokens: state.hideLowHolderTokens,
-        hideFraudContracts: state.hideFraudContracts,
-        hideDustTransactions: state.hideDustTransactions,
-        dustThresholdGwei: state.dustThresholdGwei,
-        utcTimestamps: state.utcTimestamps,
-        fraudContracts: state.fraudContracts,
-        tokenHolderCache: state.tokenHolderCache,
-        theme: state.theme,
-        debugMode: state.debugMode,
-        currentView: state.currentView,
-        selectedWallet: state.selectedWallet,
-        selectedAddress: state.selectedAddress,
-        selectedToken: state.selectedToken,
-        viewData: state.viewData,
-        viewStack: state.viewStack,
-    };
-    await storageSet({ autistmask: persisted });
+// Every field written to and read from the single "autistmask" storage key.
+// hasWallet is deliberately excluded from the diffing/merge logic below —
+// like loadState() does, it is always derived from `wallets`, never carried
+// as an independent value.
+const PERSISTED_FIELDS = Object.keys(DEFAULT_STATE)
+    .filter((key) => key !== "hasWallet")
+    .concat([
+        "currentView",
+        "selectedWallet",
+        "selectedAddress",
+        "selectedToken",
+        "viewData",
+        "viewStack",
+    ]);
+
+// Turn a raw stored (or missing) record into the full, defaulted shape
+// loadState() used to assign directly onto `state`. Pulled out as a pure
+// function so saveState() can apply it too: the fields THIS page did not
+// change still have to come from storage in their loaded-and-normalized
+// form, not as the raw bytes another page (or an old release) left there —
+// otherwise a legacy shape a load has always self-healed in memory (a
+// missing networkEndpoints map, an out-of-range flag) is dropped right back
+// into storage unfixed every time the page that DID normalize it saves
+// something unrelated, because that field's value never "changed" for that
+// page to notice.
+function normalizePersisted(saved) {
+    saved = saved || {};
+    const out = {};
+    out.wallets = saved.wallets || [];
+    // Derived, never trusted verbatim off storage — see loadState().
+    out.hasWallet = out.wallets.length > 0;
+    out.trackedTokens = saved.trackedTokens || [];
+    out.networkId = saved.networkId || DEFAULT_STATE.networkId;
+    out.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
+    out.blockscoutUrl = saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
+    // An actual object is required, not merely a truthy non-array: the code
+    // below and onChainSwitch() index and ASSIGN INTO this value, and
+    // assigning a property to a string or a number is a silent no-op in
+    // sloppy mode. Copied rather than referenced, nested pairs included, so
+    // normalizing never mutates the object a caller handed in.
+    const rawEndpoints =
+        typeof saved.networkEndpoints === "object" &&
+        saved.networkEndpoints !== null &&
+        !Array.isArray(saved.networkEndpoints)
+            ? saved.networkEndpoints
+            : {};
+    out.networkEndpoints = {};
+    for (const netId of Object.keys(rawEndpoints)) {
+        out.networkEndpoints[netId] = { ...rawEndpoints[netId] };
+    }
+    // A profile written before this map existed carries exactly one pair of
+    // endpoints, belonging to whatever network it was last on. Adopt it as
+    // that network's remembered pair, so a custom endpoint set on the old
+    // build is not lost by the first switch away and back.
+    if (!out.networkEndpoints[out.networkId]) {
+        out.networkEndpoints[out.networkId] = {
+            rpcUrl: out.rpcUrl,
+            blockscoutUrl: out.blockscoutUrl,
+        };
+    }
+    out.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
+    out.activeAddress = saved.activeAddress || null;
+    out.allowedSites =
+        saved.allowedSites && !Array.isArray(saved.allowedSites)
+            ? saved.allowedSites
+            : {};
+    out.deniedSites =
+        saved.deniedSites && !Array.isArray(saved.deniedSites)
+            ? saved.deniedSites
+            : {};
+    out.rememberSiteChoice =
+        saved.rememberSiteChoice !== undefined
+            ? saved.rememberSiteChoice
+            : true;
+    out.showZeroBalanceTokens =
+        saved.showZeroBalanceTokens !== undefined
+            ? saved.showZeroBalanceTokens
+            : true;
+    // A profile written before this setting existed has no key for it. It
+    // is a safety filter, so absent must load as on, not as undefined.
+    out.hideSpoofedSymbols =
+        saved.hideSpoofedSymbols !== undefined
+            ? saved.hideSpoofedSymbols
+            : true;
+    out.hideLowHolderTokens =
+        saved.hideLowHolderTokens !== undefined
+            ? saved.hideLowHolderTokens
+            : true;
+    out.hideFraudContracts =
+        saved.hideFraudContracts !== undefined
+            ? saved.hideFraudContracts
+            : true;
+    out.hideDustTransactions =
+        saved.hideDustTransactions !== undefined
+            ? saved.hideDustTransactions
+            : true;
+    out.dustThresholdGwei =
+        saved.dustThresholdGwei !== undefined
+            ? saved.dustThresholdGwei
+            : 100000;
+    out.utcTimestamps =
+        saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+    out.fraudContracts = saved.fraudContracts || [];
+    out.tokenHolderCache = saved.tokenHolderCache || {};
+    out.theme = saved.theme || "system";
+    out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;
+    out.currentView = saved.currentView || null;
+    out.selectedWallet =
+        saved.selectedWallet !== undefined ? saved.selectedWallet : null;
+    out.selectedAddress =
+        saved.selectedAddress !== undefined ? saved.selectedAddress : null;
+    out.selectedToken = saved.selectedToken || null;
+    out.viewData = saved.viewData || {};
+    out.viewStack = restorableStack(saved.viewStack, out.currentView);
+    return out;
+}
+
+// The persisted fields as they stood at the end of this page's last
+// loadState() or saveState(). saveState() diffs the live state against this
+// to find only the fields THIS page actually changed.
+//
+// Deep-cloned, not a reference: callers mutate persisted objects and arrays
+// in place (state.wallets.push(...)), and a reference baseline would mutate
+// right along with `state`, so the diff would always come out empty.
+let baseline = null;
+
+function snapshotPersisted() {
+    const out = {};
+    for (const key of PERSISTED_FIELDS) out[key] = state[key];
+    return out;
+}
+
+function deepEqual(a, b) {
+    if (a === b) return true;
+    if (typeof a !== "object" || typeof b !== "object") return false;
+    if (a === null || b === null) return false;
+    if (Array.isArray(a) !== Array.isArray(b)) return false;
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length) return false;
+    for (const key of aKeys) {
+        if (!Object.prototype.hasOwnProperty.call(b, key)) return false;
+        if (!deepEqual(a[key], b[key])) return false;
+    }
+    return true;
+}
+
+// Stable identity for a wallet, independent of its position in the array
+// (which shifts under a concurrent add/delete elsewhere) and independent of
+// its mutable fields (name is user-editable; addresses gains/loses entries
+// via scanning and deleteAddress.js). An "hd"/"xprv" wallet's xpub never
+// changes for its lifetime and is already enforced unique
+// (findWalletByXpub() in addWallet.js). A "key" wallet has no xpub, exactly
+// one address for its whole lifetime (nothing ever adds to or removes from
+// a key wallet's address list), and that address is already enforced
+// unique (findWalletByAddress()) — so it stands in for identity there.
+// Neither invariant is enforced by this function or by
+// mergeListByIdentity() below — they hold only because every wallet-
+// creation path in addWallet.js happens to populate one or the other before
+// the wallet ever reaches state.wallets, and because canRemoveAddress() in
+// walletDelete.js never lets a wallet's address list go to zero. A wallet
+// with neither (an empty/legacy/corrupt record) falls back to the same
+// "addr:" identity as every other such record, which is a genuine
+// collision, not a proxy for one — see the collision handling in
+// mergeListByIdentity().
+function walletIdentity(wallet) {
+    if (wallet.xpub) return "xpub:" + wallet.xpub;
+    const first = wallet.addresses && wallet.addresses[0];
+    return "addr:" + (first ? String(first.address).toLowerCase() : "");
+}
+
+// Stable identity for an address within one wallet's address list. An
+// address is unique within its wallet and, once derived or imported, never
+// changes — only whether it is present.
+function addressIdentity(addr) {
+    return String(addr.address).toLowerCase();
+}
+
+// Merge one array of identity-bearing objects (wallets, or the addresses
+// inside one wallet) by identity rather than by array index — an index
+// shifts under a concurrent insert/delete elsewhere, which would merge the
+// wrong pair of objects entirely.
+//
+// `theirs` (fresh storage) sets the membership baseline and the order:
+//   - An item this page never had baseline knowledge of, but that is in
+//     `theirs`, was added by someone else — kept as-is.
+//   - An item `base` had and `ours` no longer has was deleted by THIS page
+//     — dropped even though `theirs` still has it (this page's own delete
+//     must win over a background save that only touched leaf fields).
+//   - An item present in both `ours` and `theirs` is merged leaf-by-leaf via
+//     `mergeItem`, so a leaf this page changed (e.g. a renamed wallet) lands
+//     on top of `theirs`' otherwise-current copy (e.g. a refreshed balance).
+// Anything left in `ours` that `base` never had and `theirs` does not have
+// yet is this page's own new addition — appended.
+//
+// `identityOf` is not guaranteed collision-free (walletIdentity() falls
+// back to one shared "addr:" value for any wallet with neither an xpub nor
+// a populated first address). Two records that collide under it must never
+// silently collapse into one — that is exactly how this function used to
+// drop a wallet, encryptedSecret included, with no error and no log. Two
+// defenses:
+//   - `ours` is indexed into GROUPS, not a single item per identity, so two
+//     colliding live items on this page can't overwrite each other in the
+//     index before the merge below even runs.
+//   - A matched pair with no shared `base` entry (neither page ever agreed
+//     on this identity) is only merged leaf-by-leaf when the two sides are
+//     already equal. If they differ, that is not "the same record edited
+//     twice", it is two different records that happen to share an identity
+//     — both are kept, unmerged, rather than guessing which one is real.
+function mergeListByIdentity(base, ours, theirs, identityOf, mergeItem) {
+    base = base || [];
+    ours = ours || [];
+    theirs = theirs || [];
+    const baseIndex = new Map(base.map((item) => [identityOf(item), item]));
+    const oursIndex = new Map();
+    for (const item of ours) {
+        const id = identityOf(item);
+        if (!oursIndex.has(id)) oursIndex.set(id, []);
+        oursIndex.get(id).push(item);
+    }
+
+    const result = [];
+    const seen = new Set();
+
+    for (const theirItem of theirs) {
+        const id = identityOf(theirItem);
+        seen.add(id);
+        const oursGroup = oursIndex.get(id);
+        if (baseIndex.has(id) && !oursGroup) continue;
+        if (oursGroup) {
+            const baseItem = baseIndex.get(id);
+            if (!baseItem && !deepEqual(oursGroup[0], theirItem)) {
+                log.errorf(
+                    "state: identity collision merging",
+                    JSON.stringify(id),
+                    "- keeping both records instead of dropping one",
+                );
+                result.push(theirItem, ...oursGroup);
+            } else {
+                result.push(mergeItem(baseItem, oursGroup[0], theirItem));
+                for (let i = 1; i < oursGroup.length; i++) {
+                    result.push(oursGroup[i]);
+                }
+            }
+        } else {
+            result.push(theirItem);
+        }
+    }
+
+    for (const item of ours) {
+        const id = identityOf(item);
+        if (seen.has(id)) continue;
+        if (!baseIndex.has(id)) result.push(item);
+    }
+
+    return result;
+}
+
+// Merge one wallet's scalar/leaf fields (name, encryptedSecret, nextIndex,
+// ...) against base, then recurse into its address list by identity. `base`
+// is null when this page created the wallet itself and no other page has
+// (yet) produced a same-identity record — nothing to merge in that case,
+// this page's own copy wins outright. mergeListByIdentity() only ever calls
+// this with `!base` when `ours` and `theirs` are already equal (a genuine
+// collision between two DIFFERENT same-identity records is caught and kept
+// as two separate entries before this function is reached), so returning
+// `ours` here can't discard a different wallet's data.
+function mergeWallet(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (key === "addresses") continue;
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    merged.addresses = mergeListByIdentity(
+        base.addresses,
+        ours.addresses,
+        theirs.addresses,
+        addressIdentity,
+        mergeAddress,
+    );
+    return merged;
+}
+
+// Merge one address's leaf fields (balance, ensName, tokenBalances, ...).
+// tokenBalances is itself an array, but only backgroundRefresh() ever
+// writes it and always wholesale (refreshBalances() in
+// src/shared/balances.js), so there is no membership to reconcile within
+// it — it is a leaf like balance or ensName, not a list with its own
+// identity.
+function mergeAddress(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    return merged;
+}
+
+// Merge a plain object keyed by string (allowedSites/deniedSites: address ->
+// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
+// same way mergeListByIdentity() merges an array — by key, not by whole-
+// object diff — so a key one page added or removed applies independently of
+// a key another page edited. Unlike an array's identity function, an object
+// key can't collide with a different logical entry (Object.keys() is
+// already deduplicated), so this needs no collision floor of its own.
+function mergeMapByKey(base, ours, theirs, mergeLeaf) {
+    base = base || {};
+    ours = ours || {};
+    theirs = theirs || {};
+    const result = {};
+    const seen = new Set();
+
+    for (const key of Object.keys(theirs)) {
+        seen.add(key);
+        const inBase = Object.prototype.hasOwnProperty.call(base, key);
+        const inOurs = Object.prototype.hasOwnProperty.call(ours, key);
+        if (inBase && !inOurs) continue; // this page deleted the whole entry
+        if (inOurs) {
+            result[key] = mergeLeaf(base[key], ours[key], theirs[key]);
+        } else {
+            result[key] = theirs[key];
+        }
+    }
+
+    for (const key of Object.keys(ours)) {
+        if (seen.has(key)) continue;
+        if (!Object.prototype.hasOwnProperty.call(base, key)) {
+            result[key] = ours[key];
+        }
+    }
+
+    return result;
+}
+
+// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
+// list is itself membership, not a leaf — src/background/index.js pushes a
+// newly approved/denied hostname onto it in place, and the Settings "revoke"
+// button (src/popup/views/settings.js) filters a hostname out of it in
+// place, from a different page. Merge it the same way wallets are merged:
+// identity is the hostname itself, so a merged pair is always equal and
+// mergeItem is a no-op pick.
+function mergeHostnameList(base, ours, theirs) {
+    return mergeListByIdentity(
+        base,
+        ours,
+        theirs,
+        (hostname) => hostname,
+        (b, o, t) => t,
+    );
+}
+
+function mergeSiteMap(base, ours, theirs) {
+    return mergeMapByKey(base, ours, theirs, mergeHostnameList);
+}
+
+// networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }. onChainSwitch()
+// (src/shared/chainSwitch.js) writes state.networkEndpoints[networkId] in
+// place before saving. No code path ever removes a key from this map, so the
+// membership collision that matters for allowedSites/wallets (an add on one
+// page racing a delete on another) can't happen here — but two pages
+// switching to two different networks concurrently still race a whole-field
+// diff the same way, so it gets the same per-key merge for the leaf edit
+// case (e.g. Settings saving a custom RPC URL for the active network).
+function mergeEndpointEntry(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    return merged;
+}
+
+function mergeNetworkEndpoints(base, ours, theirs) {
+    return mergeMapByKey(base, ours, theirs, mergeEndpointEntry);
+}
+
+// Read-modify-write, merged per field, rather than one full-blob write.
+//
+// Every extension page (the toolbar popup, a dApp approval window, the
+// background's backgroundRefresh()) holds its own in-memory `state`, loaded
+// once, and showView() saves on every navigation. A full-blob write here
+// clobbers whatever a second page had written since — including, in the
+// worst case, an entire wallet and its encrypted secret with no attacker
+// and no unusual input (see the issue this fixes).
+//
+// Only the fields this page actually changed — those that differ from
+// `baseline`, captured at the last loadState()/saveState() on this page —
+// are written; every other field is carried forward from whatever is in
+// storage right now, which may already be a value another page wrote.
+//
+// `wallets` is merged structurally (mergeListByIdentity(), by wallet
+// identity and then by address identity within each wallet), not as one
+// whole field: backgroundRefresh() mutates wallets IN PLACE (addr.balance /
+// ensName / tokenBalances, via refreshBalances()), so a whole-field diff
+// would mark all of `wallets` "changed" the moment any balance moved and
+// write back background's own copy — loaded before its multi-second network
+// round trip — clobbering a wallet another page added, or resurrecting one
+// another page deleted, in that window. Merging by identity lets
+// background's leaf changes and another page's membership changes
+// (add/delete a wallet or an address) apply independently instead of
+// colliding as the same field.
+//
+// `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
+// by address key and then by hostname within each address's list), for the
+// identical reason: src/background/index.js pushes a newly
+// approved/denied hostname onto them in place, and the Settings "revoke"
+// button (src/popup/views/settings.js) filters one out in place, from a
+// different page. A whole-field diff here doesn't just lose data, it is a
+// security defect — a stale page's save can resurrect a just-revoked site
+// permission, or silently wipe a permission just granted elsewhere.
+//
+// `networkEndpoints` gets the same treatment too (mergeNetworkEndpoints(),
+// by network id), since onChainSwitch() writes into it in place; the value
+// per key is a small leaf object with no membership of its own; see the
+// comment at mergeEndpointEntry() for why the collision this closes is
+// milder than the other two.
+//
+// Every other persisted field stays a whole-field diff:
+// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
+// per-element identity to merge by; `tokenHolderCache` is a map shaped like
+// the ones above, but nothing in src/ ever writes an entry into it — it is
+// only ever reset wholesale to `{}` (onChainSwitch()) — so there is no
+// in-place mutation for a whole-field diff to collide with; `viewData` is
+// this page's own UI scratch space, not data another page has any reason to
+// share membership of.
+//
+// This does not make two pages that both change the SAME leaf concurrently
+// safe: last write wins on that one leaf, same as before. What it removes
+// is the cross-field (and now cross-membership-vs-leaf) clobber — a page
+// that only navigated, or only refreshed a balance, overwriting a wallet or
+// address list it never touched the membership of.
+//
+// This page's own live `state` is deliberately NOT rehydrated from a field
+// another page changed — only the record written to storage is merged.
+// showView() fires saveState() on every navigation without awaiting it,
+// which is what makes the queue above necessary in the first place, and a
+// save that is slow to come back has no way to tell whether the field it
+// is about to hand back is still the current answer or has since been
+// overtaken by something this very page did in the meantime; writing it
+// into `state` regardless reintroduced exactly the clobber this function
+// exists to remove, just delayed and confined to one page instead of two
+// (caught by tests/txStatus.test.js). A page's live picture of a field it
+// does not own goes on being whatever its last loadState() saw, same as
+// before this fix; only the persisted record is guaranteed current.
+async function saveStateOnce() {
+    const current = snapshotPersisted();
+    const result = await storageGet("autistmask");
+    // Normalized, not raw: a field this page did not change still has to
+    // come from storage in its loaded (self-healed) shape. See
+    // normalizePersisted() above.
+    const fresh = normalizePersisted(result.autistmask);
+
+    const merged = { ...fresh };
+    for (const key of PERSISTED_FIELDS) {
+        if (key === "wallets") {
+            merged.wallets = mergeListByIdentity(
+                baseline ? baseline.wallets : [],
+                current.wallets,
+                fresh.wallets,
+                walletIdentity,
+                mergeWallet,
+            );
+        } else if (key === "allowedSites" || key === "deniedSites") {
+            merged[key] = mergeSiteMap(
+                baseline ? baseline[key] : {},
+                current[key],
+                fresh[key],
+            );
+        } else if (key === "networkEndpoints") {
+            merged.networkEndpoints = mergeNetworkEndpoints(
+                baseline ? baseline.networkEndpoints : {},
+                current.networkEndpoints,
+                fresh.networkEndpoints,
+            );
+        } else if (
+            baseline === null ||
+            !deepEqual(current[key], baseline[key])
+        ) {
+            merged[key] = current[key];
+        }
+    }
+    merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
+
+    await storageSet({ autistmask: merged });
+
+    // Derived from this page's own wallets, never adopted off the wire —
+    // see loadState(). Everything else this page did not change is left
+    // exactly as it stood; see the note above.
+    state.hasWallet = state.wallets.length > 0;
+
+    baseline = structuredClone(snapshotPersisted());
+}
+
+// showView() calls saveState() on every navigation without awaiting it, so
+// two saves from the SAME page can be in flight at once — e.g. a screen
+// shown, then immediately replaced before the first save's storageGet()
+// round trip has come back. Left concurrent, the first save's turn would
+// finish after the second's live-state mutation and then re-hydrate `state`
+// from what IT read, stomping the second, later change back to a stale
+// value — the same clobber this function exists to prevent, just between
+// two saves on one page instead of two pages. Queuing makes every save's
+// snapshot-diff-write-rehydrate run start to finish before the next one
+// begins, so each one only ever sees the true live state at its turn.
+let saveQueue = Promise.resolve();
+
+function saveState() {
+    const turn = saveQueue.then(saveStateOnce);
+    // The queue must advance even when a save rejects, or every save after
+    // it queues behind a promise that never settles.
+    saveQueue = turn.catch(() => {});
+    return turn;
 }
 
 async function loadState() {
     const result = await storageGet("autistmask");
     if (result.autistmask) {
-        const saved = result.autistmask;
-        state.wallets = saved.wallets || [];
-        // Derived, never read from storage: a profile persisted with the flag
-        // out of step with the wallet list would otherwise stay broken on
-        // every load. Nothing depends on the two disagreeing.
-        state.hasWallet = state.wallets.length > 0;
-        state.trackedTokens = saved.trackedTokens || [];
-        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
-        state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
-        state.blockscoutUrl =
-            saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
-        // An actual object is required, not merely a truthy non-array: the
-        // code below and onChainSwitch() index and ASSIGN INTO this value,
-        // and assigning a property to a string or a number is a silent no-op
-        // in sloppy mode. A stored primitive would therefore be re-persisted
-        // unchanged forever, and every switch would fall back to the network
-        // default — the endpoint loss this map exists to prevent, with no
-        // self-healing. The allowedSites/deniedSites guards below are only
-        // read from, which is why they can be looser.
-        state.networkEndpoints =
-            typeof saved.networkEndpoints === "object" &&
-            saved.networkEndpoints !== null &&
-            !Array.isArray(saved.networkEndpoints)
-                ? saved.networkEndpoints
-                : {};
-        // A profile written before this map existed carries exactly one pair
-        // of endpoints, belonging to whatever network it was last on. Adopt
-        // it as that network's remembered pair, so a custom endpoint set on
-        // the old build is not lost by the first switch away and back.
-        if (!state.networkEndpoints[state.networkId]) {
-            state.networkEndpoints[state.networkId] = {
-                rpcUrl: state.rpcUrl,
-                blockscoutUrl: state.blockscoutUrl,
-            };
-        }
-        state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
-        state.activeAddress = saved.activeAddress || null;
-        state.allowedSites =
-            saved.allowedSites && !Array.isArray(saved.allowedSites)
-                ? saved.allowedSites
-                : {};
-        state.deniedSites =
-            saved.deniedSites && !Array.isArray(saved.deniedSites)
-                ? saved.deniedSites
-                : {};
-        state.rememberSiteChoice =
-            saved.rememberSiteChoice !== undefined
-                ? saved.rememberSiteChoice
-                : true;
-        state.showZeroBalanceTokens =
-            saved.showZeroBalanceTokens !== undefined
-                ? saved.showZeroBalanceTokens
-                : true;
-        // A profile written before this setting existed has no key for it.
-        // It is a safety filter, so absent must load as on, not as undefined.
-        state.hideSpoofedSymbols =
-            saved.hideSpoofedSymbols !== undefined
-                ? saved.hideSpoofedSymbols
-                : true;
-        state.hideLowHolderTokens =
-            saved.hideLowHolderTokens !== undefined
-                ? saved.hideLowHolderTokens
-                : true;
-        state.hideFraudContracts =
-            saved.hideFraudContracts !== undefined
-                ? saved.hideFraudContracts
-                : true;
-        state.hideDustTransactions =
-            saved.hideDustTransactions !== undefined
-                ? saved.hideDustTransactions
-                : true;
-        state.dustThresholdGwei =
-            saved.dustThresholdGwei !== undefined
-                ? saved.dustThresholdGwei
-                : 100000;
-        state.utcTimestamps =
-            saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
-        state.fraudContracts = saved.fraudContracts || [];
-        state.tokenHolderCache = saved.tokenHolderCache || {};
-        state.theme = saved.theme || "system";
-        state.debugMode =
-            saved.debugMode !== undefined ? saved.debugMode : false;
-        state.currentView = saved.currentView || null;
-        state.selectedWallet =
-            saved.selectedWallet !== undefined ? saved.selectedWallet : null;
-        state.selectedAddress =
-            saved.selectedAddress !== undefined ? saved.selectedAddress : null;
-        state.selectedToken = saved.selectedToken || null;
-        state.viewData = saved.viewData || {};
-        state.viewStack = restorableStack(saved.viewStack, state.currentView);
+        Object.assign(state, normalizePersisted(result.autistmask));
     }
+    // The point of comparison every saveState() on this page diffs against,
+    // whether storage had a profile or was empty. See PERSISTED_FIELDS above
+    // saveState() for why a reference here would be wrong.
+    baseline = structuredClone(snapshotPersisted());
 }
 
 function currentAddress() {

tests/deleteWalletLostPassword.test.js

@@ -0,0 +1,503 @@
+// The lost-password route off the delete-wallet screen (issue #312).
+//
+// What is pinned here is that a user who has forgotten the password can
+// still get out — no password is asked for and none is checked — and that
+// the escape hatch destroys exactly the wallet it names and nothing else.
+// The second half is the dangerous one: this is the only control in the
+// product that erases key material without the password that encrypted it,
+// so an off-by-one in the wallet it removes would take a wallet whose
+// owner never asked for it to be touched.
+//
+// The assertions are made against what came back OUT of extension storage,
+// not against the live `state` object. Deleting a wallet in memory and
+// never persisting it looks identical from `state`, and a build that never
+// wrote at all would pass a check that only reads `state` back.
+//
+// That makes the storage stub load-bearing, so it is a real store that
+// structured-clones on both `set` and `get`. A stub whose `get` hands back
+// the same object its `set` was given aliases the caller's own array: the
+// test then reads its own in-memory mutation and calls it persistence, and
+// passes against a build that persists nothing (see issue #324). The
+// aliasing is closed off explicitly by the first test below rather than
+// left as an assumption about `structuredClone`.
+//
+// The view is driven against a minimal DOM stub, in the same shape as
+// tests/exportPrivkey.test.js: the module reads and writes named nodes and
+// needs nothing else from a document.
+
+const mockSettingsShow = jest.fn();
+jest.mock("../src/popup/views/settings", () => ({
+    show: mockSettingsShow,
+}));
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+}));
+
+const { RESTORABLE_VIEWS } = require("../src/popup/restorableViews");
+
+const VIEW = "delete-wallet-lost-password";
+
+// Fixed addresses — never used for anything but these tests.
+const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
+const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+
+// ------------------------------------------------------------ DOM stub
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        appendChild: () => {},
+        remove: () => {},
+        querySelectorAll: () => [],
+    };
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        addEventListener: () => {},
+        body: { prepend: () => {} },
+    };
+}
+
+// --------------------------------------------------------- storage stub
+
+// A store that behaves the way `chrome.storage.local` does: what goes in is
+// serialized, so the caller keeps no handle on what came to rest there, and
+// what comes out is a fresh object the caller may mutate freely.
+function makeStorage() {
+    let store = {};
+    return {
+        get: async (keys) => {
+            const wanted =
+                keys === undefined || keys === null
+                    ? Object.keys(store)
+                    : [].concat(keys);
+            const out = {};
+            for (const key of wanted) {
+                if (key in store) out[key] = structuredClone(store[key]);
+            }
+            return out;
+        },
+        set: async (items) => {
+            for (const [key, value] of Object.entries(items)) {
+                store[key] = structuredClone(value);
+            }
+        },
+        // Test-only: what the extension would find on a cold start.
+        _raw: () => structuredClone(store),
+    };
+}
+
+// ------------------------------------------------------------ harness
+
+function wallet(name, secret, addresses) {
+    return {
+        type: "hd",
+        name,
+        xpub: "xpub-" + name,
+        encryptedSecret: secret,
+        nextIndex: addresses.length,
+        addresses: addresses.map((address) => ({
+            address,
+            balance: "0.0000",
+            tokenBalances: [],
+        })),
+    };
+}
+
+function load() {
+    jest.resetModules();
+    mockSettingsShow.mockClear();
+
+    const storage = makeStorage();
+    const sent = [];
+    globalThis.chrome = {
+        storage: { local: storage },
+        runtime: { sendMessage: (msg) => sent.push(msg) },
+    };
+    globalThis.document = makeDocument();
+
+    const helpers = require("../src/popup/views/helpers");
+    const { state } = require("../src/shared/state");
+    const vault = require("../src/shared/vault");
+    const deleteWallet = require("../src/popup/views/deleteWallet");
+
+    state.hasWallet = true;
+    state.wallets = [
+        wallet("Wallet 1", "secret-one", [A0, A1]),
+        wallet("Wallet 2", "secret-two", [B0]),
+        wallet("Wallet 3", "secret-three", [C0]),
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    state.activeAddress = A0;
+    state.allowedSites = { [A0]: ["a.example"], [B0]: ["b.example"] };
+    state.deniedSites = { [B0]: ["c.example"], [C0]: ["d.example"] };
+    state.viewStack = ["main", "settings"];
+    state.currentView = "settings";
+
+    const renderWalletList = jest.fn();
+    deleteWallet.init({ renderWalletList });
+
+    return { helpers, state, vault, deleteWallet, storage, sent };
+}
+
+function click(id) {
+    const el = globalThis.document.getElementById(id);
+    return Promise.all((el.listeners.click || []).map((fn) => fn()));
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// The wallets as the extension would read them back on a cold start.
+async function persistedWallets(storage) {
+    const result = await storage.get("autistmask");
+    return result.autistmask.wallets;
+}
+
+// Open the lost-password screen for a wallet, the way the user does.
+async function openLostPassword(deleteWallet, walletIdx) {
+    deleteWallet.show(walletIdx);
+    await click("btn-delete-wallet-lost-password");
+}
+
+// ------------------------------------------------------------ tests
+
+// The stub is what every persistence assertion below rests on, so its one
+// dangerous failure mode is closed off first. An aliasing store passes
+// every other test in this file against a build that never writes.
+describe("the storage stub", () => {
+    test("does not hand back the object it was given", async () => {
+        const storage = makeStorage();
+        const written = { wallets: [{ name: "Wallet 1" }] };
+
+        await storage.set({ autistmask: written });
+        written.wallets.push({ name: "Wallet 2" });
+        written.wallets[0].name = "renamed after the write";
+
+        const readBack = (await storage.get("autistmask")).autistmask;
+        expect(readBack.wallets).toHaveLength(1);
+        expect(readBack.wallets[0].name).toBe("Wallet 1");
+
+        // And the other direction: mutating what came out must not reach
+        // back into the store.
+        readBack.wallets[0].name = "renamed after the read";
+        const again = (await storage.get("autistmask")).autistmask;
+        expect(again.wallets[0].name).toBe("Wallet 1");
+    });
+});
+
+describe("reaching the screen", () => {
+    test("the delete screen offers the route", async () => {
+        const { deleteWallet, state } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        expect(state.currentView).toBe(VIEW);
+        expect(node("delete-wallet-lost-name").textContent).toBe("Wallet 2");
+        expect(node("delete-wallet-lost-name-echo").textContent).toBe(
+            "Wallet 2",
+        );
+    });
+
+    // Both delete screens hang off Settings. Pushing one onto the other
+    // would leave Back on the confirm screen popping onto itself.
+    test("it does not push the screen it came from", async () => {
+        const { deleteWallet, state } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        expect(state.viewStack).toEqual(["main", "settings"]);
+    });
+
+    test("Back returns to the delete screen with its wallet still chosen", async () => {
+        const { deleteWallet, state } = load();
+        await openLostPassword(deleteWallet, 1);
+        await click("btn-delete-wallet-lost-back");
+
+        expect(state.currentView).toBe("delete-wallet-confirm");
+        expect(node("delete-wallet-name").textContent).toBe("Wallet 2");
+        expect(state.viewStack).toEqual(["main", "settings"]);
+
+        // The confirm screen is usable, not merely on screen: the wallet
+        // it holds is the one that was chosen, so its own button does not
+        // answer "No wallet selected for deletion."
+        node("delete-wallet-password").value = "some password";
+        const { decryptWithPassword } = require("../src/shared/vault");
+        decryptWithPassword.mockRejectedValue(new Error("nope"));
+        await click("btn-delete-wallet-confirm");
+        expect(node("delete-wallet-flash").textContent).toBe(
+            "That password is incorrect. Please try again.",
+        );
+    });
+});
+
+describe("the typed confirmation", () => {
+    test("a name that is not the wallet's deletes nothing", async () => {
+        const { deleteWallet, state, storage } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 3";
+        await click("btn-delete-wallet-lost-confirm");
+
+        expect(node("delete-wallet-lost-flash").textContent).toBe(
+            "That is not the name of this wallet. Type Wallet 2 to confirm.",
+        );
+        expect(node("delete-wallet-lost-flash").style.visibility).toBe(
+            "visible",
+        );
+        expect(state.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+            "Wallet 3",
+        ]);
+        expect(state.currentView).toBe(VIEW);
+        // Nothing was destroyed on disk either. Storage is not empty —
+        // showView() persists the current screen on the way in — so what
+        // is asserted is that all three wallets are still in it.
+        const persisted = await persistedWallets(storage);
+        expect(persisted.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+            "secret-three",
+        ]);
+    });
+
+    test("an empty field deletes nothing", async () => {
+        const { deleteWallet, state } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        await click("btn-delete-wallet-lost-confirm");
+
+        expect(node("delete-wallet-lost-flash").style.visibility).toBe(
+            "visible",
+        );
+        expect(state.wallets).toHaveLength(3);
+    });
+
+    // Not a secret and not a password: it asks whether the user knows
+    // which wallet they are on. Refusing the name they can plainly read,
+    // over letter case, would only teach them to distrust the control.
+    test("case and surrounding spaces do not matter", async () => {
+        const { deleteWallet, state, storage } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "  wALLet 2 ";
+        await click("btn-delete-wallet-lost-confirm");
+
+        expect(state.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 3",
+        ]);
+        expect(await persistedWallets(storage)).toHaveLength(2);
+    });
+
+    // A name with a doubled inner space RENDERS with one — HTML collapses
+    // runs of whitespace — so the string the user can see and type is not
+    // the string the name is stored as. Comparing the two raw would make
+    // this wallet's confirmation impossible to satisfy by any typing at
+    // all, wedging the one screen that exists to unwedge people.
+    test("a doubled space inside the name is typed back as one", async () => {
+        const { deleteWallet, state, storage } = load();
+        state.wallets[1].name = "My  Wallet";
+        await openLostPassword(deleteWallet, 1);
+
+        // What the DOM was handed still has both spaces; what the user
+        // reads off the screen, and therefore types, has one.
+        expect(node("delete-wallet-lost-name").textContent).toBe("My  Wallet");
+        node("delete-wallet-lost-name-input").value = "My Wallet";
+        await click("btn-delete-wallet-lost-confirm");
+
+        expect(state.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 3",
+        ]);
+        const persisted = await persistedWallets(storage);
+        expect(persisted.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-three",
+        ]);
+    });
+});
+
+describe("deleting without the password", () => {
+    test("no password is asked for and none is checked", async () => {
+        const { deleteWallet, vault, storage } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 2";
+        await click("btn-delete-wallet-lost-confirm");
+
+        expect(vault.decryptWithPassword).not.toHaveBeenCalled();
+        expect(await persistedWallets(storage)).toHaveLength(2);
+    });
+
+    // The load-bearing assertion of the whole file, and the one that says
+    // this control is safe to give a user who cannot prove anything: it
+    // removes the wallet it named, and every other wallet survives intact,
+    // key material included.
+    test("exactly the named wallet is destroyed", async () => {
+        const { deleteWallet, storage } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 2";
+        await click("btn-delete-wallet-lost-confirm");
+
+        const wallets = await persistedWallets(storage);
+        expect(wallets.map((w) => w.name)).toEqual(["Wallet 1", "Wallet 3"]);
+        expect(wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-three",
+        ]);
+        expect(wallets.map((w) => w.xpub)).toEqual([
+            "xpub-Wallet 1",
+            "xpub-Wallet 3",
+        ]);
+        expect(wallets[0].addresses.map((a) => a.address)).toEqual([A0, A1]);
+        expect(wallets[1].addresses.map((a) => a.address)).toEqual([C0]);
+
+        // The deleted wallet's secret is gone from storage entirely, not
+        // merely unreferenced by the wallet list.
+        expect(JSON.stringify(storage._raw())).not.toContain("secret-two");
+        expect(JSON.stringify(storage._raw())).not.toContain("xpub-Wallet 2");
+    });
+
+    test("only the deleted wallet's site permissions are dropped", async () => {
+        const { deleteWallet, storage } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 2";
+        await click("btn-delete-wallet-lost-confirm");
+
+        const saved = (await storage.get("autistmask")).autistmask;
+        expect(saved.allowedSites).toEqual({ [A0]: ["a.example"] });
+        expect(saved.deniedSites).toEqual({ [C0]: ["d.example"] });
+    });
+
+    // The route shares finishDelete() with the password route, so the
+    // selection repair and the accountsChanged broadcast are the same on
+    // both. Deleting a wallet that did not own the active address must
+    // leave that address, and the selection, exactly where they were.
+    test("a selection in another wallet is left alone", async () => {
+        const { deleteWallet, storage, sent } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 2";
+        await click("btn-delete-wallet-lost-confirm");
+
+        const saved = (await storage.get("autistmask")).autistmask;
+        expect(saved.activeAddress).toBe(A0);
+        expect(saved.selectedWallet).toBe(0);
+        expect(saved.selectedAddress).toBe(0);
+        expect(sent).toEqual([]);
+        // Settings is stubbed, so this is where the route hands over, not
+        // where it renders.
+        expect(mockSettingsShow).toHaveBeenCalled();
+    });
+
+    test("deleting the wallet holding the active address moves it and says so", async () => {
+        const { deleteWallet, storage, sent } = load();
+        await openLostPassword(deleteWallet, 0);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 1";
+        await click("btn-delete-wallet-lost-confirm");
+
+        const saved = (await storage.get("autistmask")).autistmask;
+        expect(saved.wallets.map((w) => w.name)).toEqual([
+            "Wallet 2",
+            "Wallet 3",
+        ]);
+        expect(saved.activeAddress).toBe(B0);
+        expect(sent).toEqual([{ type: "AUTISTMASK_ACTIVE_CHANGED" }]);
+    });
+
+    test("deleting the last wallet lands on Welcome with nothing left", async () => {
+        const { deleteWallet, state, storage } = load();
+        state.wallets = [wallet("Wallet 1", "secret-one", [A0])];
+        state.allowedSites = { [A0]: ["a.example"] };
+        state.deniedSites = {};
+
+        await openLostPassword(deleteWallet, 0);
+        node("delete-wallet-lost-name-input").value = "Wallet 1";
+        await click("btn-delete-wallet-lost-confirm");
+
+        const saved = (await storage.get("autistmask")).autistmask;
+        expect(saved.wallets).toEqual([]);
+        expect(saved.hasWallet).toBe(false);
+        expect(saved.activeAddress).toBeNull();
+        expect(saved.allowedSites).toEqual({});
+        expect(state.currentView).toBe("welcome");
+        expect(JSON.stringify(storage._raw())).not.toContain("secret-one");
+    });
+});
+
+describe("what the screen leaves behind", () => {
+    test("the typed confirmation is wiped when the screen is left", async () => {
+        const { helpers, deleteWallet } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("delete-wallet-lost-name-input").value = "Wallet 2";
+        // The Settings gear, which is not this screen's Back button.
+        helpers.showView("settings");
+
+        expect(node("delete-wallet-lost-name-input").value).toBe("");
+        expect(node("delete-wallet-lost-flash").textContent).toBe("");
+        expect(node("delete-wallet-lost-flash").style.visibility).toBe(
+            "hidden",
+        );
+    });
+
+    // Left mid-delete, the screen has to come back usable.
+    test("the confirm button is re-enabled on the way out", async () => {
+        const { helpers, deleteWallet } = load();
+        await openLostPassword(deleteWallet, 1);
+
+        node("btn-delete-wallet-lost-confirm").disabled = true;
+        helpers.showView("settings");
+
+        expect(node("btn-delete-wallet-lost-confirm").disabled).toBe(false);
+    });
+
+    // A wallet name is not a secret, so the screen is excluded for the
+    // other reason: reopening the popup must not land the user on a screen
+    // whose button erases key material.
+    test("the popup may not reopen onto it", () => {
+        expect(RESTORABLE_VIEWS.has(VIEW)).toBe(false);
+        expect(RESTORABLE_VIEWS.has("delete-wallet-confirm")).toBe(false);
+    });
+});

tests/stateMerge.test.js

@@ -0,0 +1,443 @@
+// saveState() used to write the entire state blob every time
+// (src/shared/state.js). Every extension page — the toolbar popup, a dApp
+// approval window opened by the background, backgroundRefresh() in
+// src/background/index.js — holds its own in-memory `state`, loaded once,
+// and src/popup/views/helpers.js showView() saves on EVERY navigation. So
+// any second page that saved after a first page had written something new
+// overwrote it, with no attacker and no unusual input: a whole wallet, name,
+// addresses and encrypted secret included, silently gone
+// (https://git.eeqj.de/sneak/AutistMask/issues/304).
+//
+// Both cases below drive the real state.js module through two independent
+// module registries sharing one storage backend, the way two real extension
+// pages share one chrome.storage.local. The storage stub structured-clones
+// on both get and set — a stub that hands back the object it was given
+// aliases the caller's own mutation and would make this entire defect class
+// invisible (see https://git.eeqj.de/sneak/AutistMask/issues/324).
+
+function makeStorage() {
+    let store = {};
+    return {
+        get: async (keys) => {
+            const wanted =
+                keys === undefined || keys === null
+                    ? Object.keys(store)
+                    : [].concat(keys);
+            const out = {};
+            for (const key of wanted) {
+                if (key in store) out[key] = structuredClone(store[key]);
+            }
+            return out;
+        },
+        set: async (items) => {
+            for (const [key, value] of Object.entries(items)) {
+                store[key] = structuredClone(value);
+            }
+        },
+    };
+}
+
+// One extension page: a fresh module registry over the shared storage.
+// state.js resolves the storage API at require time, so the stub has to be
+// installed before the module is loaded, and `state` is a module-level
+// singleton, so each page needs its own registry to hold its own copy.
+function loadPage(storage) {
+    jest.resetModules();
+    globalThis.chrome = { storage: { local: storage } };
+    return {
+        state: require("../src/shared/state"),
+        helpers: require("../src/popup/views/helpers"),
+    };
+}
+
+function wallet(name, secret, address) {
+    return {
+        type: "hd",
+        name,
+        xpub: "xpub-" + name,
+        encryptedSecret: secret,
+        nextIndex: 1,
+        addresses: [{ address, balance: "0", tokenBalances: [] }],
+    };
+}
+
+const W1 = wallet(
+    "Wallet 1",
+    "secret-one",
+    "0x66133E8ea0f5D1d612D2502a968757D1048c214a",
+);
+const W2 = wallet(
+    "Wallet 2",
+    "secret-two",
+    "0xdAC17F958D2ee523a2206206994597C13D831ec7",
+);
+
+// Minimal DOM: showView() toggles view elements, clears the flash line and
+// creates/removes the debug banner. Nothing here is asserted; it only has to
+// answer without throwing, the way the popup's own index.html would.
+function makeElement(id) {
+    const classes = new Set();
+    return {
+        id,
+        textContent: "",
+        style: {},
+        classList: {
+            add: (...n) => n.forEach((c) => classes.add(c)),
+            remove: (...n) => n.forEach((c) => classes.delete(c)),
+            toggle: (c, force) => {
+                const on = force === undefined ? !classes.has(c) : force;
+                if (on) classes.add(c);
+                else classes.delete(c);
+                return on;
+            },
+        },
+        remove: () => {},
+    };
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+afterEach(() => {
+    delete globalThis.chrome;
+    delete globalThis.document;
+});
+
+describe("a save from a page that never saw a wallet another page added", () => {
+    // The first DoD case on the issue: add a wallet in one page, then force
+    // a save from a second page loaded before that wallet existed. Both
+    // wallets must survive.
+    test("both wallets are in storage afterwards", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // Loaded while storage held only Wallet 1, and never reloads —
+        // the approval window in the reproduction, or a second popup that
+        // has been open for a while.
+        const stale = loadPage(storage);
+        await stale.state.loadState();
+        expect(stale.state.state.wallets).toHaveLength(1);
+
+        // A second page, loaded after, adds a wallet — the exact sequence
+        // src/popup/views/addWallet.js uses.
+        const fresh = loadPage(storage);
+        await fresh.state.loadState();
+        fresh.state.state.wallets.push(W2);
+        fresh.state.state.hasWallet = true;
+        await fresh.state.saveState();
+
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // The stale page saves something that has nothing to do with
+        // wallets — exactly what showView() does on every navigation, and
+        // what backgroundRefresh() does after a balance poll.
+        stale.state.state.currentView = "settings";
+        await stale.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+    });
+});
+
+describe("the approval-window reproduction", () => {
+    // approval window open, add a wallet in the popup, confirm the approval
+    // — the exact sequence from the issue. The approval window and the
+    // popup are the same popup code with a different starting view, so
+    // showView() is the real save path in both: src/popup/views/approval.js
+    // showTxApproval() calls showView("approve-tx") when the window opens,
+    // and a successful confirm calls
+    // src/popup/views/txStatus.js showWait() -> startWait(), which calls
+    // showView("wait-tx") — the save that clobbered the second wallet in
+    // the reproduction on the issue.
+    test("the wallet added in the popup survives confirming the approval", async () => {
+        globalThis.document = makeDocument();
+
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // The background opens the approval window on the approve-tx
+        // screen; nothing else has happened yet.
+        const approvalWindow = loadPage(storage);
+        await approvalWindow.state.loadState();
+        approvalWindow.helpers.showView("approve-tx");
+        // showView() does not await its own saveState(); an extra save
+        // joins the same queue and only resolves once that one has too,
+        // which is the black-box way to know it landed.
+        await approvalWindow.state.saveState();
+
+        // The user adds a wallet in the popup — a separate page, loaded
+        // after the approval window.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.push(W2);
+        popup.state.state.hasWallet = true;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // The user confirms the approval. The approval window navigates
+        // approve-tx -> wait-tx, saving again from state it loaded before
+        // Wallet 2 ever existed.
+        approvalWindow.helpers.showView("wait-tx");
+        await approvalWindow.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+    });
+});
+
+// backgroundRefresh() (src/background/index.js) loads state, spends seconds
+// on network I/O in refreshBalances() (src/shared/balances.js) mutating
+// addr.balance/ensName/tokenBalances IN PLACE on the wallets it already
+// knew about, then saves. Precondition 2 on the issue: that refresh window
+// overlapping a membership change (add or delete) on another page must not
+// clobber or resurrect a wallet — a whole-field diff on `wallets` failed
+// this, because "background changed a balance" and "another page changed
+// membership" collided as the same field.
+describe("background refresh racing a wallet added on another page", () => {
+    test("the wallet added elsewhere survives background's stale balance save", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // "background": loads first, and its save is the one that lands
+        // last, modeling the multi-second network round trip in between.
+        const background = loadPage(storage);
+        await background.state.loadState();
+        background.state.state.wallets[0].addresses[0].balance = "1.2345";
+
+        // A second page, loaded after, adds a wallet while background's
+        // refresh is still in flight.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.push(W2);
+        popup.state.state.hasWallet = true;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // background's save lands last, carrying only its balance update.
+        await background.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+        // The balance update itself must not be lost either — this is a
+        // merge, not deletion-always-wins.
+        expect(persisted.wallets[0].addresses[0].balance).toBe("1.2345");
+    });
+});
+
+describe("background refresh racing a wallet deleted on another page", () => {
+    test("the wallet deleted elsewhere stays deleted after background's stale balance save", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1, W2] } });
+
+        const background = loadPage(storage);
+        await background.state.loadState();
+        background.state.state.wallets[0].addresses[0].balance = "1.2345";
+
+        // A second page deletes Wallet 2 while background's refresh is in
+        // flight — the same splice deleteWallet.js's removeWalletFromState()
+        // does.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.splice(1, 1);
+        popup.state.state.hasWallet = popup.state.state.wallets.length > 0;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(1);
+
+        await background.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual(["Wallet 1"]);
+        expect(persisted.wallets[0].addresses[0].balance).toBe("1.2345");
+    });
+});
+
+// allowedSites/deniedSites: { [address]: [hostname, ...] }. Mutated in place
+// from two different contexts — src/background/index.js:592-599 pushes a
+// newly approved hostname onto state.allowedSites[activeAddress], and the
+// Settings "revoke" button (src/popup/views/settings.js:55-68) filters a
+// hostname out of state[key][addr] in place, deleting the address key
+// entirely once its list is empty — the exact membership-vs-whole-field
+// pattern that made the whole-field `wallets` diff unsafe, on a
+// security-relevant field: a stale whole-field save here can resurrect a
+// revoked permission or wipe a freshly granted one.
+const ADDR1 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const ADDR2 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+
+function approveSite(pageState, address, hostname) {
+    if (!pageState.allowedSites[address]) {
+        pageState.allowedSites[address] = [];
+    }
+    if (!pageState.allowedSites[address].includes(hostname)) {
+        pageState.allowedSites[address].push(hostname);
+    }
+}
+
+function revokeSite(pageState, hostname) {
+    for (const addr of Object.keys(pageState.allowedSites)) {
+        pageState.allowedSites[addr] = pageState.allowedSites[addr].filter(
+            (h) => h !== hostname,
+        );
+        if (pageState.allowedSites[addr].length === 0) {
+            delete pageState.allowedSites[addr];
+        }
+    }
+}
+
+describe("a dApp approval racing a stale Settings page's later save", () => {
+    test("the fresh approval survives Settings revoking an unrelated site", async () => {
+        const storage = makeStorage();
+        await storage.set({
+            autistmask: {
+                wallets: [W1],
+                allowedSites: { [ADDR2]: ["other.example"] },
+            },
+        });
+
+        // Settings loads first, and its save lands last — before either has
+        // any idea a dApp approval happened elsewhere in between.
+        const settings = loadPage(storage);
+        await settings.state.loadState();
+
+        // A dApp approval window, opened later, approves a new site for a
+        // different address and saves — the real sequence at
+        // src/background/index.js:592-599.
+        const approval = loadPage(storage);
+        await approval.state.loadState();
+        approveSite(approval.state.state, ADDR1, "dapp.example");
+        await approval.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
+        ).toEqual(["dapp.example"]);
+
+        // Settings revokes its own, unrelated site — the real sequence at
+        // src/popup/views/settings.js:55-68 — and saves from state loaded
+        // before the dApp approval ever happened.
+        revokeSite(settings.state.state, "other.example");
+        await settings.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.allowedSites[ADDR1]).toEqual(["dapp.example"]);
+        expect(persisted.allowedSites[ADDR2]).toBeUndefined();
+    });
+});
+
+describe("a revoked site permission against a stale page's later save", () => {
+    test("the revocation holds even when the stale page approves something else", async () => {
+        const storage = makeStorage();
+        await storage.set({
+            autistmask: {
+                wallets: [W1],
+                allowedSites: { [ADDR1]: ["evil.example"] },
+            },
+        });
+
+        // A stale page loads while the permission still stands.
+        const stale = loadPage(storage);
+        await stale.state.loadState();
+
+        // Settings revokes it — src/popup/views/settings.js:55-68 — from a
+        // second page.
+        const settings = loadPage(storage);
+        await settings.state.loadState();
+        revokeSite(settings.state.state, "evil.example");
+        await settings.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
+        ).toBeUndefined();
+
+        // The stale page, unaware of the revoke, approves an unrelated site
+        // for a different address and saves — src/background/index.js:592-599.
+        approveSite(stale.state.state, ADDR2, "good.example");
+        await stale.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.allowedSites[ADDR2]).toEqual(["good.example"]);
+        expect(persisted.allowedSites[ADDR1]).toBeUndefined();
+    });
+});
+
+// mergeListByIdentity()'s identity function is not guaranteed collision-free
+// — walletIdentity() falls back to one shared "addr:" value for any wallet
+// with neither an xpub nor a populated first address (a legacy or corrupt
+// record). Two such records created independently on two different pages
+// must not silently collapse into one, dropping the loser's
+// encryptedSecret with no error and no log.
+function legacyWallet(name, secret) {
+    return {
+        type: "legacy",
+        name,
+        encryptedSecret: secret,
+        nextIndex: 0,
+        addresses: [],
+    };
+}
+
+describe("two wallets independently created with a colliding identity", () => {
+    test("both survive, encryptedSecret included, instead of one silently replacing the other", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // Both pages load before either has created their malformed wallet,
+        // so neither has baseline knowledge of the other's.
+        const pageA = loadPage(storage);
+        await pageA.state.loadState();
+        const pageB = loadPage(storage);
+        await pageB.state.loadState();
+
+        pageA.state.state.wallets.push(legacyWallet("Legacy A", "secret-a"));
+        pageA.state.state.hasWallet = true;
+        await pageA.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        pageB.state.state.wallets.push(legacyWallet("Legacy B", "secret-b"));
+        pageB.state.state.hasWallet = true;
+        await pageB.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        const secrets = persisted.wallets.map((w) => w.encryptedSecret);
+        expect(secrets).toContain("secret-one");
+        expect(secrets).toContain("secret-a");
+        expect(secrets).toContain("secret-b");
+    });
+});