fix: a popup save no longer undoes a network switch the background saved during it (closes #641)

The popup's saveState() and the background's updateState() each read the
stored record, change it and write it back, and each was ordered only within
its own context, so a write by one could land between the other's read and
write and be lost. Both now hold the browser's lock (navigator.locks, shared
by every page and the background) from the read to the write, through
withLock() in src/shared/browserApi.js; the recovery screen's reset takes it
too. The lock also orders a page's own saves, so both per-context queues are
gone. The unit tests get a small lock from a Jest setup file.

Model: opus-5-5

README.md

@@ -1253,14 +1253,24 @@ Decoding). So a step whose USDT-for-USDC swap action could not be read, with a
 A V4 step with no swap action sets only the sides its `SETTLE`, `SETTLE_ALL`,
 `TAKE` or `TAKE_ALL` names.
 
-An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side is WETH,
+An `UNWRAP_WETH` step makes `Token Out` ETH only when no step set the output
-on mainnet or Sepolia, or when no step set the output side; a WETH
+side, or when the output side is WETH, on mainnet or Sepolia, that the step that
-`Min. received` figure then reads in ETH. Otherwise `Token Out` and
+set it paid to the router and that the router still holds when the `UNWRAP_WETH`
-`Min. received` keep the output side's own token and figure, whether the swap
+runs (Transaction Decoding below gives what the router holds). The router
-was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
+unwraps only the WETH it holds, so WETH that step paid to the user, or to anyone
-unwraps the WETH it did not spend shows USDC. The token permission warning on
+else, stays WETH: a swap that pays the router WETH, then a swap that pays the
-the signature screen has its own amount wording, including `Unknown`; the
+user WETH, then an unwrap, shows WETH with the second swap's minimum. The
-SignApproval section below describes it.
+minimum reads in ETH when that step paid all its WETH to the router. When it
+paid only part of it to the router, as a V4 step does that `TAKE`s some of its
+WETH to the user and the rest to the router, or paid the router WETH beside a
+payout the decoder cannot read, the swap shows ETH with no minimum: the decoder
+does not count how much of that step's minimum reaches the router, nor read the
+`UNWRAP_WETH`'s own minimum. A later step that sets the output side sets it
+anew. Otherwise `Token Out` and `Min. received` keep the output side's own token
+and figure, whether the swap was paid in ETH or in a token: a V2 exact-out swap
+that buys USDC and then unwraps the WETH it did not spend shows USDC. The token
+permission warning on the signature screen has its own amount wording, including
+`Unknown`; the SignApproval section below describes it.
 
 The swap's `Deadline` line is the router's deadline as a UTC date and time, e.g.
 `2026-02-27 08:25:51`. A JavaScript date reaches only to 275760-09-13 00:00:00
@@ -1379,6 +1389,17 @@ carries a `schemaVersion` — `STATE_SCHEMA_VERSION` in
 `saveState()` and the background's `updateState()` both do, so whichever context
 wrote last, the record says which build's shape it is in.
 
+Each write reads the record, changes it and writes it back, holding a lock from
+the read to the write: the browser's own (`navigator.locks`), which every page
+of the extension and its background share, taken through `withLock()` in
+`src/shared/browserApi.js`. The popup's `saveState()`, the background's
+`updateState()` and the StateRecovery reset all take it, so no write lands
+between another write's read and its write, where it would be lost. Chrome has
+it from version 69, older than any Chrome that runs a Manifest V3 extension, in
+pages and in the service worker; Firefox from version 96, older than the 115
+`manifest/firefox.json` declares. Where it is missing, a write fails rather than
+going ahead without it.
+
 Version 1 is the shape that shipped before versions existed, so a stored record
 with no `schemaVersion` is version 1 rather than a defect: it loads normally and
 is migrated in place by being stamped on the first write. An upgrade never shows

package.json

@@ -13,6 +13,11 @@
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
+    "jest": {
+        "setupFiles": [
+            "<rootDir>/tests/support/navigatorLocks.js"
+        ]
+    },
     "devDependencies": {
         "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "4.3.1",

src/background/state.js

@@ -16,17 +16,19 @@
 //                     across any number of awaits and no concurrent work can
 //                     move it.
 //   updateState(fn)   read fresh, apply fn to that fresh record, write it
-//                     back — all inside a queue, so two background writes
+//                     back — all holding the lock every write of the stored
-//                     never interleave, and the read is one storage round trip
+//                     record takes, so no other write, by the background or a
-//                     ahead of the write rather than a page lifetime ahead of
+//                     page, lands in between, and the read is one storage
-//                     it (which is what made the popup's saveState() need a
+//                     round trip ahead of the write rather than a page
-//                     per-field merge against a baseline at all).
+//                     lifetime ahead of it (which is what made the popup's
+//                     saveState() need a per-field merge against a baseline
+//                     at all).
 //
 // A handler that must both read and write therefore does its network work
 // against a snapshot it owns, and applies the RESULT inside updateState().
 // It never publishes an object other in-flight work is holding.
 
-const { storageGet, storageSet } = require("../shared/browserApi");
+const { storageGet, storageSet, withLock } = require("../shared/browserApi");
 const { normalizePersisted } = require("../shared/persistedState");
 const {
     STATE_SCHEMA_VERSION,
@@ -51,11 +53,6 @@ async function getState() {
     return normalizePersisted(result.autistmask);
 }
 
-// Serializes the read-modify-write turns below. Two of them interleaved would
-// each read before the other wrote, and the second write would carry the first
-// one's fields back to their pre-turn values.
-let updateQueue = Promise.resolve();
-
 async function updateStateOnce(mutate) {
     const s = await getState();
     await mutate(s);
@@ -70,27 +67,21 @@ async function updateStateOnce(mutate) {
 
 // Apply `mutate` to a record read fresh from storage and write the result
 // back. `mutate` receives a detached, normalized profile and mutates it in
-// place; it may be async, but it must not do anything slow — the window
+// place; it may be async, but it must not do anything slow. The write is the
-// between the read and the write is the window in which another context's
+// WHOLE record, which is safe only because the lock (withLock() in
-// write is lost, and keeping it to one storage round trip is what makes a
+// src/shared/browserApi.js) is held from the read to the write: two
-// whole-record write safe here. Concretely: the write is the WHOLE record, so
+// background turns, or a turn and a page's save, never interleave
-// a popup write that lands inside that window is reverted, in every field, by
+// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every page's save waits
-// the record this turn read before it. That is accepted because the window is
+// while it is held.
-// one round trip long and the popup is not writing while the worker is;
-// widening it is what would make it a real hazard.
 //
 // `mutate` must also not call updateState() itself, directly or through
-// anything it awaits: the queue is strictly serial, so the inner turn waits on
+// anything it awaits: the inner turn waits for the lock the outer one holds,
-// the outer one, which is waiting on the inner one. That deadlocks the whole
+// and the outer one is waiting on the inner one. That deadlocks every write of
-// background, not just the caller. Mutate the record you were handed.
+// the stored record, not just the caller. Mutate the record you were handed.
 //
 // Resolves with the record that was written.
 function updateState(mutate) {
-    const turn = updateQueue.then(() => updateStateOnce(mutate));
+    return withLock("autistmask", () => updateStateOnce(mutate));
-    // The queue must advance even when a turn rejects, or every update after
-    // it queues behind a promise that never settles.
-    updateQueue = turn.catch(() => {});
-    return turn;
 }
 
 module.exports = { getState, updateState };

src/popup/views/stateRecovery.js

@@ -24,7 +24,11 @@
 // than written again locally so that tests/popupElementIds.test.js sees these
 // lookups and holds every id below against the markup.
 const { $, VIEWS } = require("./helpers");
-const { storageGet, storageRemove } = require("../../shared/browserApi");
+const {
+    storageGet,
+    storageRemove,
+    withLock,
+} = require("../../shared/browserApi");
 const { log } = require("../../shared/log");
 
 // Typed in full before anything is erased, in the same spirit as the wallet
@@ -137,7 +141,9 @@ async function resetProfile() {
         return;
     }
     try {
-        await storageRemove("autistmask");
+        // Under the lock every write of the stored record takes, so the erase
+        // cannot land between another write's read and its write and be undone.
+        await withLock("autistmask", () => storageRemove("autistmask"));
     } catch (e) {
         log.errorf("state recovery: reset failed:", e);
         setFlash("The saved data could not be erased. Nothing was changed.");

src/shared/browserApi.js

@@ -219,6 +219,32 @@ function storageRemove(keys) {
     return Promise.resolve(storage.remove(keys));
 }
 
+/**
+ * Run `fn` while holding the browser's lock called `name`
+ * (`navigator.locks`), and settle as `fn` settles. Every page of the extension
+ * and its background share these locks, so while one of them holds `name`
+ * another asking for it waits, in the order they asked. The lock is let go
+ * when `fn` settles, whether it resolved or rejected.
+ *
+ * Every write of the stored record holds the lock named after its key,
+ * "autistmask", from its read to its write: saveState() in
+ * src/shared/state.js, updateState() in src/background/state.js, and the
+ * reset in src/popup/views/stateRecovery.js.
+ *
+ * @param {string} name
+ * @param {function(): Promise<*>} fn
+ * @returns {Promise<*>} what `fn` resolved with.
+ * @throws rejects, without running `fn`, where `navigator.locks` is absent.
+ */
+function withLock(name, fn) {
+    if (typeof navigator === "undefined" || !navigator.locks) {
+        return Promise.reject(
+            new Error("navigator.locks is not available in this context"),
+        );
+    }
+    return navigator.locks.request(name, () => fn());
+}
+
 // `storage.session`, the browser's session storage: what is kept there lasts
 // until the browser closes. It survives the background worker being stopped
 // and started again, which module-level variables do not (README, Background
@@ -373,4 +399,5 @@ module.exports = {
     windowsGetLastFocused,
     windowsRemove,
     windowsUpdate,
+    withLock,
 };

src/shared/state.js

@@ -35,7 +35,7 @@ const {
     migrationNeeded,
 } = require("./stateSchema");
 
-const { storageGet, storageSet } = require("./browserApi");
+const { storageGet, storageSet, withLock } = require("./browserApi");
 const { log } = require("./log");
 
 // The live record the proxy below guards. Everything inside this module reads
@@ -458,8 +458,8 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // This page's own live `state` is deliberately NOT rehydrated from a field
 // another page changed — only the record written to storage is merged.
 // showView() fires saveState() on every navigation without awaiting it,
-// which is what makes the queue above necessary in the first place, and a
+// which is why saves from one page wait for each other (see saveState()), and
-// save that is slow to come back has no way to tell whether the field it
+// a save that is slow to come back has no way to tell whether the field it
 // is about to hand back is still the current answer or has since been
 // overtaken by something this very page did in the meantime; writing it
 // into `state` regardless reintroduced exactly the clobber this function
@@ -535,24 +535,11 @@ async function saveStateOnce() {
     baseline = current;
 }
 
-// showView() calls saveState() on every navigation without awaiting it, so
-// two saves from the SAME page can be in flight at once — e.g. a screen
-// shown, then immediately replaced before the first save's storageGet()
-// round trip has come back. Left concurrent, the first save's turn would
-// finish after the second's live-state mutation and then re-hydrate `state`
-// from what IT read, stomping the second, later change back to a stale
-// value — the same clobber this function exists to prevent, just between
-// two saves on one page instead of two pages. Queuing makes every save's
-// snapshot-diff-write-rehydrate run start to finish before the next one
-// begins, so each one only ever sees the true live state at its turn.
-let saveQueue = Promise.resolve();
-
 // Where a failed save is REPORTED, set once by the context that has a screen
 // to say it on (src/popup/index.js).
 //
 // A save that fails must not fail silently. showView() fires saveState() on
-// every navigation without awaiting it, and the queue below has to attach a
+// every navigation without awaiting it, so a failing save was swallowed
-// rejection handler to keep advancing — so a failing save was swallowed
 // entirely: no throw, no message, nothing on screen. The wallet kept running
 // against storage that was rejecting every write, which is the data-loss half
 // of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
@@ -583,11 +570,18 @@ function reportSaveFailure(err) {
     }
 }
 
+// Each save runs start to finish holding the lock every write of the stored
+// record takes (withLock() in src/shared/browserApi.js), so no write by
+// another page or the background lands between its read and its write and is
+// lost (https://git.eeqj.de/sneak/AutistMask/issues/641).
+//
+// The same lock orders this page's own saves. showView() calls saveState() on
+// every navigation without awaiting it, so two saves from one page can be
+// asked for at once; they take the lock in the order they were asked, and each
+// compares the page's state as it stands when its turn begins against the
+// baseline the save before it left.
 function saveState() {
-    const turn = saveQueue.then(saveStateOnce);
+    const turn = withLock("autistmask", saveStateOnce);
-    // The queue must advance even when a save rejects, or every save after
-    // it queues behind a promise that never settles.
-    saveQueue = turn.catch(() => {});
     // Every failed save is reported, whether or not the caller awaited this
     // one. The returned promise still rejects, so a caller that DOES await
     // keeps its own error handling.

src/shared/uniswap.js

@@ -1219,6 +1219,16 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         let minOutput = null;
         let outputEstablished = false;
         let hasUnwrapWeth = false;
+        // Set when an UNWRAP_WETH pays out, as ETH, the output side's WETH,
+        // which the router holds; cleared whenever the output side is set
+        // again.
+        let outputUnwrapped = false;
+        // Where the step that set the output side paid its output: the
+        // recipient of a swap step, as written, or of each TAKE, TAKE_ALL and
+        // TAKE_PORTION of it in a V4 step, a TAKE_ALL as paid to the sender,
+        // with null for a payout of that step this decoder did not read. A
+        // BALANCE_CHECK_ERC20 pays nobody.
+        let outputRecipients = [];
         let hasV2OrV3ExactOut = false;
         let swapUndecoded = false;
         let hasSubPlan = false;
@@ -1255,11 +1265,13 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (!present(token) && !present(amount)) return;
             setInput(token, amount);
         };
-        const setOutput = (token, amount) => {
+        const setOutput = (token, amount, recipients) => {
             if (!present(token) && !present(amount)) return;
             outputToken = present(token) ? token : null;
             minOutput = present(amount) ? amount : null;
             outputEstablished = true;
+            outputUnwrapped = false;
+            outputRecipients = recipients;
         };
 
         // What the steps take from the sender beyond the amount of the step
@@ -1505,7 +1517,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         // does. It pays nobody.
                         const minBalance = allowedToFail ? 0n : b.minBalance;
                         if (!(minBalance === 0n && present(minOutput))) {
-                            setOutput(b.token, minBalance);
+                            setOutput(b.token, minBalance, []);
                         }
                     }
                 } else if (command === "V3_SWAP_EXACT_IN") {
@@ -1519,7 +1531,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         // Always update output: in multi-step swaps (V3 → V4),
                         // the last swap step determines the final output token
                         // and minimum received amount.
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        setOutput(s.tokenOut, s.amountOutMin, [s.recipient]);
                         if (!s.payerIsUser) {
                             spendFromRouter(s.tokenIn, s.amountIn);
                         }
@@ -1539,7 +1551,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         } else if (s.payerIsUser) {
                             addUserPaid(s.tokenIn, s.amountIn);
                         }
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        setOutput(s.tokenOut, s.amountOutMin, [s.recipient]);
                         if (!s.payerIsUser) {
                             spendFromRouter(s.tokenIn, s.amountIn);
                         }
@@ -1570,7 +1582,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         } else if (s.payerIsUser) {
                             addUserPaid(s.tokenIn, s.amountInMax);
                         }
-                        setOutput(s.tokenOut, s.amountOut);
+                        setOutput(s.tokenOut, s.amountOut, [s.recipient]);
                         if (!isHop(i, s.tokenOut, s.recipient)) {
                             addPayee(s.recipient, s.tokenOut);
                         }
@@ -1728,6 +1740,14 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         (p) => p.currency === v4.tokenIn,
                     );
                     const amountIn = paidIn ? paidIn.amount : v4?.amountIn;
+                    // Where the step pays its output, if it sets the output
+                    // side (see outputRecipients).
+                    const takeRecipients = v4
+                        ? v4.takes
+                              .filter((t) => t.currency === v4.tokenOut)
+                              .map((t) => t.recipient)
+                              .concat(v4.recipientUnread ? [null] : [])
+                        : [];
                     if (v4 && v4.hasSwapAction) {
                         // A step with a swap action always sets the output
                         // side, as the last swap step wins, and sets the
@@ -1744,13 +1764,15 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         outputToken = v4.tokenOut;
                         minOutput = v4.amountOutMin;
                         outputEstablished = true;
+                        outputUnwrapped = false;
+                        outputRecipients = takeRecipients;
                     } else if (v4) {
                         // A step with no swap action sets only the sides its
                         // SETTLE, SETTLE_ALL, TAKE or TAKE_ALL names:
                         // setInputOnce() and setOutput() leave alone a side
                         // whose two halves are both unstated.
                         setInputOnce(v4.tokenIn, amountIn);
-                        setOutput(v4.tokenOut, v4.amountOutMin);
+                        setOutput(v4.tokenOut, v4.amountOutMin, takeRecipients);
                     }
                     // Every V4 step, with a swap action or without, takes
                     // from the sender what the user pays it (an amount an
@@ -1772,6 +1794,29 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     }
                 } else if (command === "UNWRAP_WETH") {
                     hasUnwrapWeth = true;
+                    // The router unwraps all the WETH it holds, even when the
+                    // recipient cannot be read. The output side's WETH is
+                    // among it when the step that set the output side paid it
+                    // to the router and the router still holds WETH. WETH
+                    // that step paid to the user, or to anyone else, stays
+                    // WETH, so when that step also paid some of its output
+                    // elsewhere, or made a payout this decoder did not read,
+                    // only part of it may be unwrapped. This decoder does not
+                    // count how much of that step's minimum then reaches the
+                    // router, nor read the UNWRAP_WETH's own minimum, so the
+                    // output side keeps no figure.
+                    const toRouter = (r) => present(r) && isRouter(r);
+                    if (
+                        present(outputToken) &&
+                        WETH_ADDRESSES.includes(outputToken.toLowerCase()) &&
+                        heldByRouter.has(outputToken.toLowerCase()) &&
+                        outputRecipients.some(toRouter)
+                    ) {
+                        outputUnwrapped = true;
+                        if (!outputRecipients.every(toRouter)) {
+                            minOutput = null;
+                        }
+                    }
                     const u = decodeUnwrapWeth(inputs[i]);
                     if (u) {
                         addPayee(u.recipient);
@@ -1912,23 +1957,22 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             outputToken = null;
             minOutput = null;
             outputEstablished = true;
+            outputUnwrapped = false;
         }
 
         // Resolve token info. A null token on either side means no step named
         // a currency for it, a V4 step with a swap action left it unknown, or
         // an EXECUTE_SUB_PLAN step did; tokenInfo() refuses rather than calling
         // it ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
-        // when the output side is WETH, or when no step set the output side. A
+        // when it unwraps the output side's WETH (`outputUnwrapped`), or when
-        // V4 step with a swap action, or an EXECUTE_SUB_PLAN step, did set it,
+        // no step set the output side. A V4 step with a swap action, or
-        // even when it set it unknown. Any other output keeps its own token
+        // an EXECUTE_SUB_PLAN step, did set it, even when it set it unknown.
-        // and figure: a swap that buys USDC and then unwraps the WETH it did
+        // Any other output keeps its own token and figure: a swap that pays
-        // not spend receives USDC.
+        // its WETH to the user and then unwraps receives WETH, and one that
-        const outputIsWeth =
+        // buys USDC and then unwraps the WETH it did not spend receives USDC.
-            present(outputToken) &&
-            WETH_ADDRESSES.includes(outputToken.toLowerCase());
         const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
-            hasUnwrapWeth && (outputIsWeth || !outputEstablished)
+            outputUnwrapped || (hasUnwrapWeth && !outputEstablished)
                 ? { symbol: "ETH", decimals: 18, address: null }
                 : tokenInfo(outputToken, sources);
 

tests/confirmTxAmount.test.js

@@ -158,7 +158,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const {
     Interface,

tests/confirmTxNetworkSwitch.test.js

@@ -189,7 +189,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const {
     BaseWallet,

tests/e2e/run.js

@@ -367,11 +367,14 @@ async function leaveTransactionDetail(page) {
     await openAddressDetail(page);
 }
 
-// Back out to Home from wherever the previous test finished.
+// Back out to Home from wherever the previous test finished, and wait for the
+// save that navigation makes, so a test reading the stored stack next reads
+// the one Home left.
 async function goHome(page) {
     await leaveTransactionDetail(page);
     await page.click("#btn-address-back");
     await visible(page, "#view-main");
+    await waitForPersisted(page, "currentView", "main", "back on Home");
 }
 
 // One field of the popup's state as it was actually persisted, read out of

tests/nativeCurrency.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { state } = require("../src/shared/state");
 const { NETWORKS } = require("../src/shared/networks");

tests/sendAmountRule.test.js

@@ -97,7 +97,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { state } = require("../src/shared/state");
 const send = require("../src/popup/views/send");

tests/sendDisplayFloor.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { refreshBalances } = require("../src/shared/balances");
 const { state } = require("../src/shared/state");

tests/sendMax.test.js

@@ -146,7 +146,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { Transaction, Wallet, formatEther } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");

tests/stateWriteLock.test.js

@@ -0,0 +1,78 @@
+// A popup save reads the stored record, merges this page's changes into it
+// and writes it back. The background's write of a network the user approved
+// used to be able to land between that read and that write, and the popup's
+// write then put the old network back
+// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every write of the record
+// now holds one lock from its read to its write.
+//
+// The popup and the background run here as the real modules over one shared
+// storage stub, and share the lock the way the extension's pages and its
+// background share the browser's (tests/support/navigatorLocks.js).
+
+const { makeStorageStub } = require("./support/storageStub");
+
+function loadContexts(storage) {
+    jest.resetModules();
+    globalThis.chrome = { storage: { local: storage.local } };
+    return {
+        popup: require("../src/shared/state"),
+        background: require("../src/background/state"),
+        applyChainSwitchFields: require("../src/shared/chainSwitchFields")
+            .applyChainSwitchFields,
+    };
+}
+
+// Lets every pending promise callback run, and then some.
+function nextMacrotask() {
+    return new Promise((resolve) => setImmediate(resolve));
+}
+
+afterEach(() => {
+    delete globalThis.chrome;
+    jest.restoreAllMocks();
+});
+
+test("a network the background switches to during a popup save stays stored", async () => {
+    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
+    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
+    await popup.loadState();
+
+    // The popup navigates, so its save has a change of its own to write.
+    popup.state.currentView = "settings";
+
+    // The popup's save has read the record and is about to write it back when
+    // the user's approval of a site's switch to mainnet reaches the
+    // background. Without the lock the background's whole update runs before
+    // the next macrotask; with it, the update waits for the popup's write.
+    let backgroundSwitch;
+    const realSet = storage.local.set.getMockImplementation();
+    storage.local.set.mockImplementationOnce(async (items) => {
+        backgroundSwitch = background.updateState((fresh) =>
+            applyChainSwitchFields(fresh, "mainnet"),
+        );
+        await nextMacrotask();
+        return realSet(items);
+    });
+
+    await popup.saveState();
+    await backgroundSwitch;
+
+    const stored = storage.read("autistmask");
+    expect(stored.networkId).toBe("mainnet");
+    expect(stored.currentView).toBe("settings");
+});
+
+test("a save that fails holding the lock lets it go", async () => {
+    jest.spyOn(console, "error").mockImplementation(() => {});
+    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
+    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
+    await popup.loadState();
+
+    storage.local.set.mockRejectedValueOnce(new Error("quota exceeded"));
+    await expect(popup.saveState()).rejects.toThrow("quota exceeded");
+
+    await background.updateState((fresh) =>
+        applyChainSwitchFields(fresh, "mainnet"),
+    );
+    expect(storage.read("autistmask").networkId).toBe("mainnet");
+});

tests/support/navigatorLocks.js

@@ -0,0 +1,26 @@
+// `navigator.locks` for the unit tests, which run on node, where there is none.
+//
+// One lock per name: granted in the order it was asked for, and let go when
+// the callback settles, whether it resolved or rejected. That is what the
+// browser's own does for the one call the extension makes,
+// `navigator.locks.request(name, callback)`. Every module a test file loads
+// shares it, as every page of the extension and its background share the
+// browser's.
+//
+// Run before each test file by `setupFiles` in package.json.
+
+// For each name, a promise that settles once the last request for it has
+// let the lock go.
+const released = new Map();
+
+function request(name, callback) {
+    const previous = released.get(name) || Promise.resolve();
+    const result = previous.then(() => callback({ name, mode: "exclusive" }));
+    released.set(
+        name,
+        result.catch(() => {}),
+    );
+    return result;
+}
+
+globalThis.navigator = { locks: { request } };

tests/uniswap.test.js

@@ -875,7 +875,7 @@ describe("uniswap decoder", () => {
         const data = buildExecute(
             solidityPacked(["uint8", "uint8"], [0x08, 0x0c]),
             [
-                encodeV2SwapExactIn(USER_ADDR, 1000000n, 500000000000000n, [
+                encodeV2SwapExactIn(ROUTER_ADDR, 1000000n, 500000000000000n, [
                     USDC_ADDR,
                     SEPOLIA_WETH_ADDR,
                 ]),
@@ -958,7 +958,7 @@ describe("uniswap decoder", () => {
         const data = buildExecute(
             solidityPacked(["uint8", "uint8"], [0x08, 0x0c]),
             [
-                encodeV2SwapExactIn(USER_ADDR, 1000000n, 500000000000000n, [
+                encodeV2SwapExactIn(ROUTER_ADDR, 1000000n, 500000000000000n, [
                     USDT_ADDR,
                     WETH_ADDR,
                 ]),

tests/uniswapRecipient.test.js

@@ -7,9 +7,11 @@
 // (https://git.eeqj.de/sneak/AutistMask/issues/592), the address whose
 // balance a BALANCE_CHECK_ERC20 checks
 // (https://git.eeqj.de/sneak/AutistMask/issues/600), any token a swap
-// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606), and
+// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606),
 // what each PERMIT2_TRANSFER_FROM moves
-// (https://git.eeqj.de/sneak/AutistMask/issues/611).
+// (https://git.eeqj.de/sneak/AutistMask/issues/611), and when an
+// UNWRAP_WETH makes the output ETH
+// (https://git.eeqj.de/sneak/AutistMask/issues/607).
 //
 // Every swap command, SWEEP, WRAP_ETH, UNWRAP_WETH, TRANSFER, PAY_PORTION,
 // PAY_PORTION_FULL_PRECISION, PERMIT2_TRANSFER_FROM, ACROSS_V4_DEPOSIT_V3 and
@@ -268,18 +270,28 @@ const SWAP_USDT_FOR_ETH = [
         [[[ZERO, USDT, 500, 10, ZERO], false, USDT_2000, ONE_WETH, "0x"]],
     ),
 ];
+const SWAP_USDT_FOR_WETH = [
+    0x06, // SWAP_EXACT_IN_SINGLE
+    coder.encode(
+        [
+            "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
+        ],
+        [[[USDT, WETH, 500, 10, ZERO], true, USDT_2000, ONE_WETH, "0x"]],
+    ),
+];
 // SWAP_EXACT_IN_SINGLE with no parameters, which cannot be read.
 const UNREADABLE_SWAP = [0x06, "0x"];
 const SETTLE_USDT = [
     0x0b,
     coder.encode(["address", "uint256", "bool"], [USDT, 0n, true]),
 ];
-function take(currency, recipient) {
+// A TAKE of `amount`, by default zero: the open delta, all the step owes.
+function take(currency, recipient, amount = 0n) {
     return [
         0x0e,
         coder.encode(
             ["address", "address", "uint256"],
-            [currency, recipient, 0n],
+            [currency, recipient, amount],
         ),
     ];
 }
@@ -531,7 +543,7 @@ describe("an output left in the router is not received", () => {
         {
             kind: "an UNWRAP_WETH to the user, then the swap",
             data: execute(unwrapWeth(MSG_SENDER), toRouter),
-            min: "1.0000 ETH",
+            min: "1.0000 WETH",
         },
         {
             kind: "the swap, then a WRAP_ETH of zero to the user",
@@ -568,6 +580,171 @@ describe("an output left in the router is not received", () => {
     });
 });
 
+// https://git.eeqj.de/sneak/AutistMask/issues/607: an UNWRAP_WETH pays out,
+// as ETH, the WETH the router holds when it runs. Token Out read ETH whenever
+// the output side was WETH, so a swap that paid its WETH to the user before
+// the UNWRAP_WETH read as ETH, though the user receives WETH.
+describe("an UNWRAP_WETH makes the output ETH only when the router holds it", () => {
+    test("a swap paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
+        const result = decode(
+            execute(swapToWeth(MSG_SENDER), unwrapWeth(MSG_SENDER)),
+        );
+        expect(result.name).toBe("Swap USDT → WETH");
+        expect(labels(result)).toEqual(PAID_TO_USER);
+        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
+    });
+
+    test("a swap paying its WETH to the router, then an UNWRAP_WETH to the user, reads as ETH", () => {
+        const result = decode(
+            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER)),
+        );
+        expect(result.name).toBe("Swap USDT → ETH");
+        expect(labels(result)).toEqual(PAID_TO_USER);
+        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
+    });
+
+    // The SWEEP pays the user all the WETH the router holds, so the
+    // UNWRAP_WETH finds none of it.
+    test("a swap paying its WETH to the router, then a SWEEP of it to the user, then an UNWRAP_WETH, reads as WETH", () => {
+        const result = decode(
+            execute(
+                swapToWeth(ADDRESS_THIS),
+                sweep(WETH, MSG_SENDER),
+                unwrapWeth(MSG_SENDER),
+            ),
+        );
+        expect(result.name).toBe("Swap USDT → WETH");
+        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
+    });
+
+    // The user receives the first step's WETH as WETH and the second's as
+    // ETH. The second step sets the output side and pays its WETH to the
+    // router, so the output reads as ETH with the second step's minimum.
+    test("two swaps, the second paying its WETH to the router, then an UNWRAP_WETH, reads as ETH", () => {
+        const result = decode(
+            execute(
+                swapToWeth(MSG_SENDER),
+                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
+                    USDC,
+                    WETH,
+                ]),
+                unwrapWeth(MSG_SENDER),
+            ),
+        );
+        expect(result.name).toBe("Swap USDT → ETH");
+        expect(detail(result, "Min. received").value).toBe("0.5000 ETH");
+    });
+
+    // The same two swaps the other way round. The user receives the first
+    // step's WETH as ETH and the second's as WETH. The second step sets the
+    // output side and pays its WETH to the user, so the output reads as WETH
+    // with the second step's minimum, though the router holds the first's.
+    test("two swaps, the second paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
+        const result = decode(
+            execute(
+                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
+                    USDC,
+                    WETH,
+                ]),
+                swapToWeth(MSG_SENDER),
+                unwrapWeth(MSG_SENDER),
+            ),
+        );
+        expect(result.name).toBe("Swap USDC → WETH");
+        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
+    });
+
+    // One V4 step buys at least 1 WETH and TAKEs 0.6 WETH to the user and the
+    // rest to the router. The user receives 0.6 WETH and the rest as ETH.
+    // Neither minimum is shown: the decoder does not count how much of the
+    // step's minimum reaches the router, nor read the UNWRAP_WETH's own.
+    test("one V4 step paying part of its WETH to the user and the rest to the router, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
+        const result = decode(
+            execute(
+                v4Swap(
+                    SWAP_USDT_FOR_WETH,
+                    SETTLE_USDT,
+                    take(WETH, MSG_SENDER, (ONE_WETH * 6n) / 10n),
+                    take(WETH, ADDRESS_THIS),
+                ),
+                unwrapWeth(MSG_SENDER),
+            ),
+        );
+        expect(result.name).toBe("Swap USDT → ETH");
+        expect(labels(result)).toEqual([
+            "Protocol",
+            "Token In",
+            "Amount",
+            "Token Out",
+            "Steps",
+            "Deadline",
+        ]);
+    });
+
+    // A TAKE the decoder cannot read may pay part of the WETH to the user.
+    test("one V4 step paying WETH to the router beside a TAKE that cannot be read, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
+        const result = decode(
+            execute(
+                v4Swap(
+                    SWAP_USDT_FOR_WETH,
+                    SETTLE_USDT,
+                    withDirtyWord(take(WETH, MSG_SENDER), 1),
+                    take(WETH, ADDRESS_THIS),
+                ),
+                unwrapWeth(MSG_SENDER),
+            ),
+        );
+        expect(result.name).toBe("Swap USDT → ETH");
+        expect(detail(result, "Min. received")).toBeUndefined();
+        expect(detail(result, "Min. paid out")).toBeUndefined();
+    });
+
+    // A step after the UNWRAP_WETH that sets the output side sets it anew.
+    test("a swap paying WETH to the user after an UNWRAP_WETH of an earlier swap's WETH reads as WETH", () => {
+        const result = decode(
+            execute(
+                swapToWeth(ADDRESS_THIS),
+                unwrapWeth(MSG_SENDER),
+                v2Swap(0x08, MSG_SENDER, USDC_1990, ONE_WETH / 2n, [
+                    USDC,
+                    WETH,
+                ]),
+            ),
+        );
+        expect(result.name).toBe("Swap USDT → WETH");
+        expect(detail(result, "Min. received").value).toBe("0.5000 WETH");
+    });
+
+    // The EXECUTE_SUB_PLAN's own steps, which the decoder does not read, buy
+    // the user USDC as well, so Token Out is not named.
+    test("a swap paying its WETH to the router, then an UNWRAP_WETH, then an EXECUTE_SUB_PLAN, names no Token Out", () => {
+        const subPlan = [
+            0x21,
+            coder.encode(
+                ["bytes", "bytes[]"],
+                [
+                    "0x00",
+                    [
+                        v3SwapExactIn(
+                            MSG_SENDER,
+                            USDT_2000,
+                            USDC_1990,
+                            USDT,
+                            USDC,
+                        )[1],
+                    ],
+                ],
+            ),
+        ];
+        const result = decode(
+            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER), subPlan),
+        );
+        expect(result.name).toBe("Uniswap Swap");
+        expect(detail(result, "Token Out").value).toBe(UNDECODED);
+        expect(detail(result, "Min. received")).toBeUndefined();
+    });
+});
+
 // https://git.eeqj.de/sneak/AutistMask/issues/606: any token a step pays the
 // router stays there unless a later step pays out or spends all of it, not
 // only the swap's output. A V4 SETTLE can take more of the user's tokens than

tests/unknownScaleSend.test.js

@@ -120,7 +120,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { AbiCoder, parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");