docs: code comments name the headings README has now (closes #724)

The README rewrite renamed or merged several headings that comments still
cited. Each comment now names the current heading.

The e2e workflow's citations of "In CI" are dropped, because no section has what
they pointed at.

The comment on withLock() no longer states a Firefox private window exception,
because the manifest keeps the extension out of those windows.

Two comments also take corrections from reviews: the cases with no total in
DeleteAddress's warning, and the screens that say a swap's amount could not be
decoded.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -19,10 +19,12 @@ on: [push]
 # by the host daemon and mounts an empty directory, and the runner image's
 # node is too old to install this repo's dependencies.
 #
-# These jobs REPORT, they do not gate. No branch requires these two jobs, so
-# a failure is a red mark a reviewer has to account for. The Chrome suite has
-# failed under load before, and no such report is open. A gate that fails at
-# random teaches people to merge past red.
+# These jobs REPORT, they do not gate. Whether a check blocks a merge is
+# Gitea branch protection, which this repo does not configure, so a failure
+# here is a red mark a reviewer has to account for rather than a hard
+# block. Making e2e-chrome a required check is blocked while reports of the
+# Chrome suite failing under load are still open. A gate that fails at random
+# teaches people to merge past red.
 #
 # Nothing here may pass vacuously. There is no continue-on-error and no
 # `|| true`. Both scripts exit non-zero when docker is missing, when the

tests/e2e/run.js

@@ -5770,8 +5770,8 @@ async function main() {
     // There is no fourth: once the context is closed nothing can record,
     // because the route handler and the console listeners died with it.
     // Traffic that a test defers past the trailing drain is therefore
-    // never observed at all — a real limit of this design, and not one
-    // any post-teardown hook could close.
+    // never observed at all — a real limit of this design, stated in the
+    // README, and not one any post-teardown hook could close.
     //
     // Two green-but-vacuous runs on this harness were the same shape: a
     // record falling outside somebody's window and being dropped. First

tests/transactions.test.js

@@ -1,7 +1,7 @@
 // Tests for the address-poisoning defense in src/shared/transactions.js.
 //
-// README, Scam protection, describes four filters as a core security property
-// of the wallet: known token symbol verification, the low-holder threshold, the
+// README.md:730-814 describes four filters as a core security property of
+// the wallet: known token symbol verification, the low-holder threshold, the
 // fraud contract blocklist, and the dust threshold.  A regression in any of
 // them does not crash — it silently stops filtering, and poisoned look-alike
 // addresses reappear in the user's transaction history.  These tests pin the
@@ -46,12 +46,11 @@ const { debugFetch } = require("../src/shared/log");
 const { state } = require("../src/shared/state");
 
 // ---------------------------------------------------------------------------
-// Addresses and hashes from two real attacks. README, Scam protection, has the
-// filters that stop them.
+// Addresses and hashes from the two attacks documented in README.md:730-814.
 // ---------------------------------------------------------------------------
 
-// The fake "Ethereum" token with symbol "ETH" and zero holders. See "Known
-// symbol spoofing" and "Low-holder tokens" in README, Scam protection.
+// The fake "Ethereum" token with symbol "ETH" and zero holders
+// (README.md:735-750).
 const FAKE_ETH_CONTRACT = "0xd05339f9ea5ab9d9f03b9d57f671d2abd1f55c82";
 // The fraudulent Transfer event it emitted.
 const FAKE_ETH_TRANSFER_HASH =
@@ -63,8 +62,7 @@ const LEGIT_RECIPIENT = "0xc3c693ae04bad5f13c45885c1e85a9557798f37e";
 // The scam address the fake token transfer pointed at ("0xC3C0" vs "0xC3c6").
 const TOKEN_SCAM_LOOKALIKE = "0xc3c0aea127c575b9ffd03bf11c6a878e8979c37f";
 
-// The second wave: a real 1 gwei native transfer. See "Dust transactions" in
-// README, Scam protection.
+// The second wave: a real 1 gwei native transfer (README.md:800-808).
 const DUST_TX_HASH =
     "0x2708ebddfb9b5fa3f7a89d3ea398ef9fd8771b83ed861ecb7c21cd55d18edc74";
 const DUST_SENDER_LOOKALIKE = "0xc3c6b3b4402bd78a9582ab6b00e747769344f37e";
@@ -81,7 +79,7 @@ const NOVEL_SPAM_SYMBOL = "SPAMTKN";
 // An ordinary counterparty for legitimate-transaction fixtures.
 const ORDINARY_PEER = "0x5aa0f9f1e0a1d0e0e5c1e7ce3b7dbbe9c19f0a11";
 
-// The documented default settings (README, Settings; state.js:24-27).
+// The documented default settings (README.md:810-814, state.js:24-27).
 const DEFAULT_FILTERS = {
     hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
@@ -222,7 +220,7 @@ describe("token list assumptions the fixtures rely on", () => {
     });
 });
 
-describe("the real attacks", () => {
+describe("the real attacks documented in README.md:730-814", () => {
     test('the fake "Ethereum"/"ETH" token transfer is filtered by default', () => {
         const attack = fakeEthTokenTransfer();
         const result = filterTransactions([attack], filters());