fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668 )

Out of the box the wallet sent the user's addresses to Blockscout and each recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on Etherscan", now gate those requests. Both are off in a new install and offered unticked on Welcome and in Settings. While one is off, the screens that relied on it say so in a plain line. Each gated request reads its setting from storage before it asks and when the answer lands, and drops a late answer. An open popup takes another page's change and draws its screens again. While "Use Blockscout" is off, no address keeps an untracked token, and no screen names a token from Blockscout's report. ENS lookups ask only the RPC endpoint. Model: opus-5-5 (implementation); fable-5-1 (prose)
fix: tracked tokens' balances are read through the RPC endpoint (closes #669 )
2026-10-26 16:30:00 +00:00 · 2026-10-21 14:16:26 +02:00 · 2026-10-21 07:34:26 +02:00 · 2026-10-21 06:24:51 +02:00 · 2026-10-21 05:15:21 +02:00 · 2026-10-21 04:26:51 +02:00
79 changed files with 6341 additions and 629 deletions
@@ -12,16 +12,29 @@ intercepts tx status links to their own site instead of going to Etherscan, etc.
 None of the common alternatives work on Firefox.
 Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
-Everything you need, nothing you don't. We import as few libraries as possible,
+Everything you need, nothing you don't. We import as few libraries as possible
-don't implement any crypto, and don't send user-specific data anywhere but a
+and don't implement any crypto. By default the wallet sends user-specific data
-(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
+only to the Ethereum RPC endpoint. The user can change that endpoint in
-extension contacts three user-configurable services: the configured RPC node for
+Settings. The endpoint defaults to a public node.
-blockchain interactions, a public CoinDesk API (no API key) for realtime price
+
-information, and a Blockscout block-explorer API for transaction history and
+Out of the box the extension contacts two services:
-token balances. It also performs best-effort Etherscan address label lookups
+
-during transaction confirmation. A community-maintained phishing domain
+- the configured RPC node, for blockchain interactions
-blocklist is built into the extension at build time and checked locally; nothing
+- a public CoinDesk API (no API key), for realtime prices. The API receives
-is fetched for it at runtime.
+  token symbols and nothing else.
 Two more services are sent none of the user's data until the user ticks a
 checkbox for each. Welcome and Settings both offer the two checkboxes:
 - "Use Blockscout": a Blockscout block-explorer API, used for:
    - transaction history
    - the tokens the user has not tracked
    - transaction details
 - "Check recipients on Etherscan": a best-effort Etherscan label lookup of the
  recipient during transaction confirmation
 A community-maintained phishing domain blocklist is built into the extension at
 build time and checked locally. Nothing is fetched for it at runtime.
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -422,6 +435,35 @@ It also covers the red banner on the Settings screen: switching the network
 there to Sepolia must put up the `[TESTNET]` banner, and switching back to
 mainnet must take it down, both while Settings is still on screen.
 It also covers what a new install sends to Blockscout and Etherscan
 ([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The harness installs
 a route handler before the first popup page opens. From then on, the handler
 records every request the extension makes, from its pages and from its
 background worker. The background worker starts earlier, but it makes no request
 while it starts up. The tests take these steps in order:
 - Welcome must offer "Use Blockscout" and "Check recipients on Etherscan"
  unticked.
 - With neither ticked, Home, AddressDetail, AddressToken and ConfirmTx must each
  show the line saying what is off.
 - The popup is then closed until the background has run a balance refresh of its
  own. No recorded request may have gone to Blockscout or Etherscan.
 - "Use Blockscout" is ticked from AddressDetail's gear. On "Back", AddressDetail
  must ask Blockscout for its history and no longer say the setting is off.
  Blockscout must then be asked for the token balances.
 - The stub Blockscout then reports a token the user has not tracked. Home lists
  it. "Use Blockscout" is unticked from AddressDetail's gear. On "Back", the
  token must be gone from AddressDetail, from Send's token dropdown and from
  Home. Those three screens must each show the line saying the setting is off.
  The setting is then ticked again.
 - "Check recipients on Etherscan" is ticked from ConfirmTx's gear. On "Back",
  ConfirmTx must ask Etherscan about the recipient and show the label the stub
  page gives the recipient.
 Both settings stay on for the rest of the run. TransactionDetail with "Use
 Blockscout" off is not driven here: while the setting is off, there is no
 history row to open it from. The unit tests cover that case.
 It also covers the confirmation screen, for both a native ETH send and an ERC-20
 send: Send disabled while the fee estimate is in flight, enabled once it lands,
 the fee block quoting the expected cost and the reserve separately, the distinct
@@ -461,13 +503,15 @@ address, the transaction assertions run against the raw signed transaction
 captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
-stored network unchanged and send no `chainChanged` until it is approved, a
+stored network unchanged and send no `chainChanged` until it is approved, the
-network switch in Settings is required to send the page `chainChanged` with the
+popup open all along is required to show the `[TESTNET]` banner once a switch to
-new chain id, a prompt raised while another approval window has focus is
+Sepolia is approved and to drop it once the switch back is, a network switch in
-required to open a window of its own, and the password is required to be absent
+Settings is required to send the page `chainChanged` with the new chain id, a
-from every message the approval window sends to the background — with the
+prompt raised while another approval window has focus is required to open a
-message that would carry it required to be present, so that check cannot pass by
+window of its own, and the password is required to be absent from every message
-observing nothing. That last one is the standing floor under
+the approval window sends to the background — with the message that would carry
 it required to be present, so that check cannot pass by observing nothing. That
 last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -500,9 +544,12 @@ papered over:
  forced by clicking Reveal and the settings gear in one page task, which a
  person cannot do; the case a person can hit, the first decrypt after the popup
  opens while libsodium is still loading, is not driven.
- Approval windows open at 1280x720 whatever size the extension asks for, so
+- Approval windows open at 1280x720 whatever size the extension asks for. The
-  whether an approval screen fits its window is checked in the Firefox suite
+  site-connection prompt and the transaction approval are checked for sideways
-  only.
+  scrolling at 396x600 by sizing the page itself for that measurement only, and
  the rest of each test runs at 1280x720. That leaves out the window's frame and
  the page widening its window, so whether an approval screen fits its window is
  checked in the Firefox suite only.
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -600,9 +647,10 @@ suite), wallet creation through the UI, the Add Token screen, and the dApp round
 trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
 rejected and then approved, `eth_sendTransaction`, and a closed approval window
 rejecting with EIP-1193 4001 — driven through the real content script,
-background page and approval windows. The `personal_sign` prompt is also
+background page and approval windows. The popup open all along is required to
-required to fit its window without scrolling sideways, with the extension's
+show the `[TESTNET]` banner once the switch to Sepolia is approved and to drop
-pages at 170% zoom.
+it once the switch back is. The `personal_sign` prompt is also required to fit
 its window without scrolling sideways, with the extension's pages at 170% zoom.
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -718,13 +766,11 @@ Three limits are worth knowing, all real differences from the Chrome suite:
  in `tests/e2e/dapp.js`, which serves the dApp page and a JSON-RPC node and
  which the extension's `rpcUrl` is pointed at for the dApp steps; a JSON-RPC
  method that fixture does not model fails the run rather than answering `null`.
-  Everything else, Blockscout and the price feed among it, has no fixture and
+  The suite leaves "Use Blockscout" off, so Blockscout is not asked. A
-  simply fails, and the extension swallows its own fetch failures, so only the
+  `ReferenceError` in the success path of `renderTransactions`, or of price
-  _failure_ branches of that code are ever executed. A `ReferenceError` in the
+  rendering, passes this suite green. The offline run is also weaker than the
-  success path of `renderTransactions`, or of price rendering, passes this suite
+  Chrome suite's interception: it proves nothing got out, but it cannot report
-  green. The offline run is also weaker than the Chrome suite's interception for
+  which requests were attempted.
  those calls: it proves nothing got out, but it cannot report which requests
  were attempted.
 - **The site-connection prompt always opens in a window of its own.** The
  profile turns off `extensions.openPopupWithoutUserGesture.enabled`, so
  `src/background/index.js` falls back from the toolbar popup, which WebDriver
@@ -839,13 +885,16 @@ src/
    views/            — one JS module per screen (home, send, approval, etc.)
  shared/             — modules used by both popup and background
    alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
+    balances.js       — ETH and tracked token balances via RPC, others via
                        Blockscout while "Use Blockscout" is on
    constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
    ens.js            — ENS forward/reverse resolution (popup only)
    holders.js        — holder-count parsing and the low-holder rule
    prices.js         — ETH/USD and token/USD via CoinDesk API
    scamlist.js       — known fraud contract addresses
    state.js          — persisted state (extension storage)
    storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
                        read from storage for the requests those settings gate
    symbolSpoof.js    — the known-symbol spoof rule, shared by all surfaces
    tokenList.js      — top ERC-20 tokens by market cap (hardcoded)
    transactions.js   — tx history fetching + anti-poisoning filters
@@ -1116,23 +1165,39 @@ with the same floor (`.5` reads `.5000`).
 **Specific Exception — unknown token scale:** Calldata carries base units and no
 scale, so every amount on the dApp approval screen needs the token's `decimals`.
-It is resolved from the bundled token list, then from the tokens the user tracks
+The wallet takes the `decimals` from these sources, in this order
-on the network the transaction is for, then, when that is the active network,
+(`resolveTokenDecimals()` in `src/shared/approvalAmount.js`):
-from what the block explorer reported for the contract in the wallet's balances,
+
-which are the active network's only (`resolveTokenDecimals()` in
+- the bundled token list
-`src/shared/approvalAmount.js`). Where none of them answers, the amount is not
+- the tokens the user tracks on the network the transaction is for
-formatted: the line reads `5000000000 base units (decimals unknown)`. A guessed
+- what the block explorer reported for the contract in the wallet's balances.
-scale is not an approximation but a different number — 1,000 units of a
+  Those balances cover the active network only. This source is used only while
-6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
+  "Use Blockscout" is on (`tokenSourcesByChainId()` in
-whose only job is to state what is being authorized. Both amount paths of that
+  `src/popup/views/helpers.js`).
-screen take this rule: the ERC-20 `transfer`/`approve` line
+
-(`src/popup/views/approval.js`) and the swap's `Amount` and `Min. received`
+The token's name comes from the same sources. While "Use Blockscout" is off, a
-lines (`src/shared/uniswap.js`). The token permission warning on the signature
+token gets a line under it when the bundled list and the tracked tokens lack its
-screen takes the same rule for its amounts. An unbounded allowance or permit
+name or decimals. The line says "Blockscout's report of your balances is not
-needs no scale to describe and is still shown as `Unlimited`. A source's answer
+used to name this token, because "Use Blockscout" is off in Settings." These
-counts only if it is a whole number from 0 to 80: `decimals()` returns a
+screens show the line:
-`uint8`, but `formatUnits()` cannot format more than 80 decimal places, so a
+
-token that reports 81 to 255 is shown as one whose scale nothing knows.
+- TxApproval and SignApproval
 - WaitTx, SuccessTx and ErrorTx, which follow TxApproval
 Where none of the sources answers, the amount is not formatted: the line reads
 `5000000000 base units (decimals unknown)`. A guessed scale is not an
 approximation but a different number — 1,000 units of a 6-decimal token
 formatted at 18 decimals reads `0.000000001` — on the screen whose only job is
 to state what is being authorized. Both amount paths of that screen take this
 rule: the ERC-20 `transfer`/`approve` line (`src/popup/views/approval.js`) and
 the swap's `Amount`, `Min. received`, `Moved from the sender` and
 `Permit2 allowance` lines and the `Paid to` line of a move into the router
 (`src/shared/uniswap.js`). The token permission warning on the signature screen
 takes the same rule for its amounts. An unbounded allowance or permit needs no
 scale to describe and is still shown as `Unlimited`. A source's answer counts
 only if it is a whole number from 0 to 80: `decimals()` returns a `uint8`, but
 `formatUnits()` cannot format more than 80 decimal places, so a token that
 reports 81 to 255 is shown as one whose scale nothing knows.
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1155,18 +1220,19 @@ and compare against. Reading the stored field directly instead answers `null`
 for a bundled or tracked token the explorer merely omitted, which is not a
 refusal the wallet has any reason to make.
-The Send screen also consults every address's explorer reports, so a contract
+While "Use Blockscout" is on, the Send screen also consults every address's
-two addresses report different `decimals` for has no scale there, and the stored
+explorer reports. The reports for two addresses may give different `decimals`
-balance, formatted at one of those scales, is withdrawn with it. The Send
+for one contract. That token then has no scale on Send. Its stored balance is
-screen's `Current balance` and the confirmation screen's balance line then both
+not shown either. The Send screen's `Current balance` and the confirmation
-read `unknown (SYMBOL)`. The balance list formats each explorer row as it is
+screen's balance line then both read `unknown (SYMBOL)`. The balance list
-fetched, without that cross-address check, and shows the row's figure.
+formats each explorer row as it is fetched, without that cross-address check,
 and shows the row's figure.
 **Decoded amount lines on the transaction approval screen:** the `Amount` line
 of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
 decoded swap (see TxApproval below; `Min. received` reads `Min. paid out` unless
-only the user is paid, see Transaction Decoding), do not always read as a
+only the user is paid and no allowance goes to a spender other than the router,
-number. They can read:
+see Transaction Decoding), do not always read as a number. They can read:
 - A formatted quantity, e.g. `17.1900 USDT`, when the token's scale is known:
  truncated to four decimals, with the floor and the zero cases described above.
@@ -1235,7 +1301,11 @@ only when no earlier step set it. It finds each side by three rules:
   is their sum; in any other case the step gives no `Amount`. The decoder reads
   no amount from an exact-out action, and an open delta is not a stated amount.
   Its `Min. received` is found the same way, from the `amountOutMin` of the
-   actions that buy the output currency.
+   actions that buy the output currency, except that the step gives none when a
   swap action in it also spends the output currency, because the step then does
   not pay out all that those actions buy. A step that buys at least 0.5 WETH
   with USDT and swaps 0.3 WETH of it for USDC, with WETH as its output side,
   gives no `Min. received`.
 3. If any swap action in the step could not be read, only `SETTLE`,
   `SETTLE_ALL`, `TAKE` and `TAKE_ALL` name its sides, and the step gives no
   `Amount` or `Min. received`. A side they did not name is unknown, and the
@@ -1250,9 +1320,31 @@ Decoding). So a step whose USDT-for-USDC swap action could not be read, with a
 A V4 step with no swap action sets only the sides its `SETTLE`, `SETTLE_ALL`,
 `TAKE` or `TAKE_ALL` names.
-An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side is WETH,
+An `UNWRAP_WETH` step makes `Token Out` ETH only when no step set the output
-on mainnet or Sepolia, or when no step set the output side; a WETH
+side, or when the output side is WETH, on mainnet or Sepolia, that the step that
-`Min. received` figure then reads in ETH. Otherwise `Token Out` and
+set it paid to the router and that the router still holds when the `UNWRAP_WETH`
 runs (Transaction Decoding below gives what the router holds). The router
 unwraps only the WETH it holds, so WETH that step paid to the user, or to anyone
 else, stays WETH: a swap that pays the router WETH, then a swap that pays the
 user WETH, then an unwrap, shows WETH with the second swap's minimum. The
 minimum reads in ETH only when that step paid all its WETH to the router and
 every step between it and the `UNWRAP_WETH` is one the decoder read of these: a
 `PERMIT2_PERMIT`, a `BALANCE_CHECK_ERC20`, or a `SWEEP`, `TRANSFER`,
 `PAY_PORTION` or `PAY_PORTION_FULL_PRECISION` of a token other than WETH, but
 not of ETH to a WETH contract, which pays the router WETH. None of these can
 take WETH out of the router or pay anyone WETH; the decoder treats every other
 step as one that may. Otherwise the swap shows ETH with no minimum, as it does
 after a V4 step that `TAKE`s some of its WETH to the user and the rest to the
 router, or that pays the router WETH beside a payout the decoder cannot read,
 and with a WETH interface fee paid by `PAY_PORTION` before the `UNWRAP_WETH`:
 the decoder does not count how much of that step's minimum reaches the
 `UNWRAP_WETH`, nor read the `UNWRAP_WETH`'s own minimum. When an `UNWRAP_WETH`
 of that WETH pays the router, or its recipient cannot be read, the router may
 hold the ETH, and a later step may pay it out as WETH, as a `WRAP_ETH` of it to
 the user does: after any later step but those listed, the swap shows WETH with
 no minimum. Once the swap shows no minimum, or shows WETH this way, no later
 step, a later `UNWRAP_WETH` included, brings back the minimum or ETH; only a
 later step that sets the output side sets it anew. Otherwise `Token Out` and
 `Min. received` keep the output side's own token and figure, whether the swap
 was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
 unwraps the WETH it did not spend shows USDC. The token permission warning on
@@ -1345,25 +1437,48 @@ The core hierarchy is **Wallets → Addresses**:
 - The user can have multiple wallets, each with multiple addresses (HD) or a
  single address (key).
-Which tokens an address shows is decided by `fetchTokenBalances()` in
+Which tokens an address shows is decided on every refresh by `refreshBalances()`
-`src/shared/balances.js`, from the Blockscout `token-balances` response, so
+in `src/shared/balances.js`. The balance of each token tracked on the active
-tokens do appear without the user adding them. An ERC-20 is shown when its
+network is read with `balanceOf` through the RPC endpoint, for every address.
-balance is nonzero and it is in the bundled known-token list, is tracked by the
+Its holder count and `decimals` are those of Blockscout's entry for it in the
-user, or has 1,000 or more holders; a token claiming a symbol from the bundled
+same refresh, kept from before while Blockscout fails. A read that fails keeps
-list from any other contract address is always dropped, and so is any token
+that token's previous entry, as a failed ETH balance keeps its figure, or takes
-claiming a symbol that belongs to the native asset and therefore has no
+Blockscout's entry from the same refresh when there is none. Every other token
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
+comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens do appear without the user adding them, and they keep their previous
 figures while Blockscout fails.
 The refresh asks Blockscout only while the user has "Use Blockscout" on. The
 setting is off until the user turns it on. While it is off:
 - Only tracked tokens are listed. Turning the setting off drops every other
  token from every address at once.
 - A tracked token's entry has no holder count and no `decimals` from Blockscout.
 - A tracked token's balance uses the decimals from the bundled list, or else the
  decimals saved when the token was tracked.
 Blockscout may answer just before the user turns the setting off. So the popup's
 refresh and the background's both check the stored setting again when they save.
 If the setting is off by then, the save drops every token the user has not
 tracked.
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
 more holders. A token claiming a symbol from the bundled list from any other
 contract address is always dropped, tracked or not, and so is any token claiming
 a symbol that belongs to the native asset and therefore has no legitimate
 contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
 `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
 tokens with fewer than 1,000 holders" setting governs the transaction history
 and the send-screen token selector, not this list. A token's holder count is
 unknown when the explorer reports none, or reports anything other than a whole
 number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
 in `src/shared/holders.js`). This list does not take an unknown count as 1,000
 or more, so such a token is shown only when it is on the bundled list or
-tracked. `fetchTokenBalances()` stores every nonzero holding of a token it
+tracked. Every nonzero holding of a token shown is stored exactly, however
-admits, however small, but a holding below 0.000001 is left out of the balance
+small, but a holding below 0.000001 is left out of the balance lists, the
-lists, the send-screen token selector, the address total and the remove-address
+send-screen token selector, the address total and the remove-address warning
-warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
+(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
 zero balance" is on.
@@ -1376,6 +1491,19 @@ carries a `schemaVersion` — `STATE_SCHEMA_VERSION` in
 `saveState()` and the background's `updateState()` both do, so whichever context
 wrote last, the record says which build's shape it is in.
 Each write reads the record, changes it and writes it back, holding a lock from
 the read to the write: the browser's own (`navigator.locks`), taken through
 `withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
 background share it, except a page in a Firefox private window, which Firefox
 gives locks of its own (see https://git.eeqj.de/sneak/AutistMask/issues/646).
 The popup's `saveState()`, the background's `updateState()` and the
 StateRecovery reset all take it, so among the pages and the background that
 share it, no write lands between another write's read and its write, where it
 would be lost. Chrome has it from version 69, older than any Chrome that runs a
 Manifest V3 extension, in pages and in the service worker; Firefox from version
 96, older than the 115 `manifest/firefox.json` declares. Where it is missing, a
 write fails rather than going ahead without it.
 Version 1 is the shape that shipped before versions existed, so a stored record
 with no `schemaVersion` is version 1 rather than a defect: it loads normally and
 is migrated in place by being stamped on the first write. An upgrade never shows
@@ -1524,20 +1652,41 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
-A network switch in Settings leaves every screen beneath Settings showing the
+Changing "Use Blockscout" or "Check recipients on Etherscan" in Settings makes
-previous network, so after it "Back" behaves as in a reopened popup: every
+every screen but Settings count as not yet rendered. "Back" then renders again
-screen on the stack counts as not yet rendered, and the stack is cut at the
+any screen that a reopened popup can render. A change to "Use Blockscout" also
-first screen that cannot be rendered from saved state, such as Send or AddToken,
+cuts the stack, as a network switch does (below). The cut drops Send, whose
-or at AddressToken for any token but the native one, because that token was
+token dropdown was filled under the old setting. "Back" cannot render Send
-picked on the previous network. The cut stack is saved with the switch, so a
+again. A change to "Check recipients on Etherscan" leaves the stack as it is.
-popup closed straight after it and reopened onto Settings lands in the same
+
-place. "Back" then renders the screen it lands on for the new network, and
+Any other open popup takes either change from the stored record, as it takes a
-anything typed there and not saved, which belonged to the previous network, is
+network switch (below). That popup then redraws its top screen as a reopened
-dropped. ConfirmTx, WaitTx, SuccessTx, ErrorTx and TransactionDetail are
+popup would. A screen that a reopened popup cannot render, such as Send, is
-rendered instead for the network of the transaction they show: the network it
+replaced by Home.
-was reviewed on for ConfirmTx, and the network it was sent on for the others.
+
-Without a wallet the stack is not cut, because it starts at Welcome, which shows
+A network switch leaves every screen on the page showing the previous network.
-nothing from a network.
+The user makes it in Settings, or approves a site's request and the background
 saves it. Any other popup open meanwhile takes the switch from the stored
 record, even one saved while it was opening, and never switches the network
 itself. A switch the user picks in its Settings while it takes one is made after
 it, not overwritten by it. An approval window does not take the switch. After
 the switch, whichever way the page got it, "Back" behaves as in a reopened
 popup: every screen on the stack counts as not yet rendered, and the stack is
 cut at the first screen that cannot be rendered from saved state, such as Send
 or AddToken, or at AddressToken for any token but the native one, because that
 token was picked on the previous network and is no longer selected. The cut
 stack is saved with the popup's new network, so a popup closed straight after
 and reopened lands in the same place. The screen on top is drawn again for the
 new network: Settings in place, and any other screen as a reopened popup draws
 it, so Home takes the place of one that cannot be rendered from saved state or
 of AddressToken for a token no longer selected. "Back" then renders the screen
 it lands on for the new network, and anything typed there and not saved, which
 belonged to the previous network, is dropped. ConfirmTx, WaitTx, SuccessTx,
 ErrorTx and TransactionDetail are rendered instead for the network of the
 transaction they show: the network it was reviewed on for ConfirmTx, and the
 network it was sent on for the others. Without a wallet the stack is not cut and
 only Settings is drawn again, because the stack starts at Welcome, and Welcome
 and AddWallet show nothing from a network.
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
@@ -1556,8 +1705,17 @@ view would leave a wallet one click from deletion.
  screen in that case.
 - **Elements**:
    - "Welcome! To get started, add a wallet." text
    - A well opening with "This wallet sends your data only to the Ethereum RPC
      endpoint, unless you turn on one of these. You can change them later in
      Settings."
    - In the well, the "Use Blockscout" and "Check recipients on Etherscan"
      checkboxes, the same two as in Settings. Under each, a sentence says what
      the setting sends and to which service. Both are unticked until the user
      ticks them
    - "Add wallet" button
 - **Transitions**:
    - Ticking or unticking either checkbox → stores the setting, as Settings
      does (no screen change)
    - "Add wallet" → **AddWallet**
 #### Home (`main`)
@@ -1578,6 +1736,8 @@ view would leave a wallet one click from deletion.
      holding more than one address); the ENS name, if resolved, is below it;
      then the full address on a row of its own, followed by the address USD
      total and a balance line for ETH and for each token shown for that address
    - While "Use Blockscout" is off, a line under the wallet list: "Only tracked
      tokens are listed, because "Use Blockscout" is off in Settings."
    - "Recent Transactions": up to 25 transactions merged across every address
      of every wallet, deduplicated by hash and filtered. Each row is three
      lines: age and direction, then the counterparty's colour dot (with our own
@@ -1585,7 +1745,11 @@ view would leave a wallet one click from deletion.
      counterparty's full address on a row of its own. A contract creation has
      no counterparty: its second line is the amount alone and its third line
      says "This transaction creates a new contract. It has no recipient." The
-      transaction lists on AddressDetail and AddressToken draw the same rows
+      transaction lists on AddressDetail and AddressToken draw the same rows.
      The history comes from Blockscout. While "Use Blockscout" is off,
      Blockscout is not asked. This list then shows only the line "No
      transaction history is shown, because "Use Blockscout" is off in
      Settings."
    - "Add additional wallet..." link at bottom
 - **Transitions**:
    - Tap address row → sets the active address and broadcasts
@@ -1654,9 +1818,13 @@ view would leave a wallet one click from deletion.
    - USD total for address (see [Partial USD totals](#partial-usd-totals))
    - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
      places, USD inline). Each balance row is clickable → **AddressToken**
    - While "Use Blockscout" is off, a line under the balance list: "Only
      tracked tokens are listed, because "Use Blockscout" is off in Settings."
    - Send / Receive / + Token buttons and a "···" menu button
    - "···" dropdown containing a single "Export Private Key" entry
-    - Transaction list (with ENS resolution for counterparties)
+    - Transaction list (with ENS resolution for counterparties). While "Use
      Blockscout" is off, it shows only the line "No transaction history is
      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
    - Tap balance row → **AddressToken** (for that token)
    - "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1724,9 +1892,13 @@ view would leave a wallet one click from deletion.
    - Token contract well (ERC-20 only): full contract address (tap to copy,
      etherscan link) plus name, symbol, decimals, holder count and project
      website where known. The "Holders:" row is left out, not shown as 0, when
-      the token's balance-list entry has no holder count: the explorer did not
+      the token's balance-list entry has no holder count. That happens when:
-      report a readable one, or the token is not in the balance list
+        - the explorer did not report a readable one
-    - Token-filtered transaction list (only this token's transfers)
+        - "Use Blockscout" is off
        - the token is not in the balance list
    - Token-filtered transaction list (only this token's transfers). While "Use
      Blockscout" is off, it shows only the line "No transaction history is
      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
    - "Send" → **Send** (token locked: the dropdown is replaced by a static
      symbol and contract address)
@@ -1743,6 +1915,9 @@ view would leave a wallet one click from deletion.
    - From: address with color dot + etherscan link
    - What to send: token dropdown (or static display with contract address when
      locked from AddressToken)
    - While "Use Blockscout" is off, a line under the token dropdown: "Only
      tracked tokens are listed, because "Use Blockscout" is off in Settings."
      The line is hidden with the dropdown when Send is opened from AddressToken
    - To: address or ENS name input, with an inline validation message
    - Amount input with current balance display, which reads
      `Current balance: unknown (SYMBOL)` for a token whose scale is unknown, as
@@ -1762,13 +1937,14 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
    - "Review" (valid inputs, ENS resolved) → **ConfirmTx**
    - "Review" with an unresolvable ENS name or an invalid amount → flash
-      message, no screen change. An amount is valid when it is a number above
+      message, no screen change. A name with no address, or one resolved
-      zero, written as digits with at most one decimal point, with nothing but
+      off-chain, gets "That ENS name has no on-chain address." An amount is
-      zeros after the token's last decimal place. ETH has 18 places, and a token
+      valid when it is a number above zero, written as digits with at most one
-      with more, or with an unknown number, is held to 18. Zeros past those
+      decimal point, with nothing but zeros after the token's last decimal
-      places leave the amount unchanged, so `1.0000000` of a 6-place token
+      place. ETH has 18 places, and a token with more, or with an unknown
-      passes and is sent as exactly 1. ConfirmTx makes the same check before
+      number, is held to 18. Zeros past those places leave the amount unchanged,
-      anything can be sent
+      so `1.0000000` of a 6-place token passes and is sent as exactly 1.
      ConfirmTx makes the same check before anything can be sent
    - "Back" → previous screen (Home, AddressDetail, or AddressToken)
 #### ConfirmTx (`confirm-tx`)
@@ -1812,7 +1988,12 @@ view would leave a wallet one click from deletion.
      recipient that has never sent a transaction and holds no ETH, recipient is
      a contract, burn address, and an Etherscan phishing/scam label. An address
      that has received ETH but never sent a transaction still holds that ETH,
-      so it gets no warning
+      so it gets no warning. The Etherscan label check is made only while "Check
      recipients on Etherscan" is on. While the setting is off, the Etherscan
      box is left out. A line in its place says "This address was not checked on
      Etherscan, because "Check recipients on Etherscan" is off in Settings."
      The box or the line is chosen when the screen is drawn, so neither moves
      anything later
    - Errors (an invalid amount), plus five reserved error boxes, so the balance
      and the fee arriving later move nothing — the amount exceeds the balance
      (for a token whose scale is unknown it says the token's balance is
@@ -1889,6 +2070,9 @@ view would leave a wallet one click from deletion.
      `Unknown (could not be decoded)` with no symbol, not the transaction's ETH
      value. When that swap's `Token In` is `ETH (native)`, the transaction's
      ETH value in the network's currency, as for any other transaction
    - A line under the amount, worded as on TxApproval. While "Use Blockscout"
      is off, the line shows when the bundled list and the tracked tokens lack
      the token's name or decimals.
    - To: color dot + full address + etherscan link; for a contract creation,
      which has no recipient, "This transaction creates a new contract. It has
      no recipient." instead
@@ -1921,7 +2105,9 @@ view would leave a wallet one click from deletion.
 - **Elements**:
    - "Transaction Confirmed" heading
    - Decoded action well (shown when the transaction carried recognized
-      calldata; the top-level Amount and To are hidden in that case)
+      calldata; the top-level Amount and To are hidden in that case). Each token
      in the well gets TxApproval's line under it whenever TxApproval would show
      that line.
    - Amount + symbol
    - To: color dot + full address + etherscan link, or for a contract creation
      the same sentence as on WaitTx
@@ -1944,6 +2130,7 @@ view would leave a wallet one click from deletion.
    - Amount + symbol, or for a swap the approval screen showed no `Amount` for,
      the same as on WaitTx: `Unknown (could not be decoded)`, unless its
      `Token In` is `ETH (native)`
    - While "Use Blockscout" is off, the same line under the amount as on WaitTx
    - To: color dot + full address + etherscan link, or for a contract creation
      the same sentence as on WaitTx
    - Error message (dashed border box)
@@ -1978,7 +2165,11 @@ view would leave a wallet one click from deletion.
  AddressToken. The screen describes the transaction on the network it was sent
  on, whichever network is active: its block, network details, decoded details
  and raw data are read from that network's Blockscout, the one Settings has for
-  it, and its etherscan links open that network's explorer.
+  it, and its etherscan links open that network's explorer. While "Use
  Blockscout" is off, Blockscout is not asked. One line then takes the place of
  the block, network details, decoded details and raw data: "This screen shows
  no block, decoded details, network details or raw data, because "Use
  Blockscout" is off in Settings."
 - **Elements** (grouped into logical blocks using light well containers; field
  labels are self-explanatory so groups have no headings):
    - "Transaction" heading, "Back" button
@@ -1986,7 +2177,11 @@ view would leave a wallet one click from deletion.
    - Type: transaction classification — one of: Native ETH Transfer, ERC-20
      Token Transfer, Swap, Token Approval, Contract Call, Contract Creation. A
      transfer with a token contract is an ERC-20 Token Transfer whatever symbol
-      the token reports.
+      the token reports. A call named `execute` or `multicall` is a Swap, here
      and on its history row, only when it was sent to one of the Universal
      Router addresses Uniswap publishes for the network it was sent on (see
      Transaction Decoding); sent to any other contract, its history row shows
      the method name and this line reads Contract Call.
    - Status: "Success" or "Failed"
    - From: blockie + color dot + full address (tap to copy) + etherscan link;
      ENS name if available
@@ -2050,12 +2245,28 @@ view would leave a wallet one click from deletion.
      none, and the tokens tracked on that network, and sends `chainChanged`
      with the new chain id to every open tab. A token is tracked only on the
      network it was added on, because a contract address names a token on one
-      network only. Choosing the network already active changes nothing and
+      network only. Switching also clears every address's balances. A balance
-      sends nothing
+      refresh, by the popup or the background, stores what it fetched only if
      the stored network is still the one it fetched on when it returns, so the
      previous network's balances never reach the new one. Choosing the network
      already active changes nothing and sends nothing
    - Ethereum RPC: endpoint URL input + "Save" button (validated against
      `eth_chainId` before being saved)
-    - Blockscout API: endpoint URL input + "Save" button (validated against
+    - Blockscout API:
-      `/stats` before being saved)
+        - "Use Blockscout" checkbox, unticked until the user ticks it
        - A sentence saying what the setting shows and what it sends. With the
          setting on, the wallet sends the Blockscout API the user's addresses
          and the hash of each transaction opened
        - Endpoint URL input + "Save" button. "Save" asks the URL for `/stats`
          and saves the URL only if that request succeeds. The request carries
          no user data and is made whether or not "Use Blockscout" is ticked.
    - Etherscan:
        - "Check recipients on Etherscan" checkbox, unticked until the user
          ticks it
        - A sentence saying the setting sends each recipient's address to
          Etherscan, to check the address for a phishing or scam label
    - Each of the two settings applies to every network. Welcome offers the same
      two checkboxes
    - Token Spam Protection:
        - "Hide fake tokens impersonating a known symbol" checkbox
        - "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2079,6 +2290,10 @@ view would leave a wallet one click from deletion.
    - Debug: hidden until revealed, then an "Enable debug mode" checkbox that
      turns on the red banner and verbose logging
 - **Transitions**:
    - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
      stores the setting (no screen change). From then on, every screen drawn
      and every balance refresh uses the new setting. Unticking "Use Blockscout"
      also drops every token the user has not tracked from every address
    - "+ Add wallet" → **AddWallet**
    - "+ Add token" → **SettingsAddToken**
    - `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2097,7 +2312,8 @@ view would leave a wallet one click from deletion.
      nothing and tells the background nothing
    - Ten clicks on the version → reveals the Debug well (no screen change)
    - "Back" (or Settings gear again) → previous screen (Home); after a network
-      switch, the stack is cut first (see the top of Screen Map)
+      switch or a change to "Use Blockscout", the stack is cut first (see the
      top of Screen Map)
 #### ShowRecoveryPhrase (`show-phrase`)
@@ -2254,6 +2470,8 @@ view would leave a wallet one click from deletion.
      money. The predicate is `addressHoldsFunds()` in
      `src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
      warning, never a refusal.
    - While "Use Blockscout" is off, a line under the warning: "Only tracked
      tokens are listed, because "Use Blockscout" is off in Settings."
    - The rule that a wallet always keeps at least one address, and that
      removing the last one means deleting the wallet from Settings
    - Error line
@@ -2380,10 +2598,18 @@ view would leave a wallet one click from deletion.
      transaction"
    - Decoded action (if calldata is recognized): action name, token details,
      amounts, what each swap step spends that the `Amount` line does not give,
-      what each `PERMIT2_TRANSFER_FROM` moves and where to, steps, deadline, and
+      what each `PERMIT2_TRANSFER_FROM` moves and where to, what each
-      unless a swap pays only the From address, a `Paid to` line for each other
+      `PERMIT2_PERMIT` whose amount is not the `Amount` figure, and each
-      address it pays, or saying that a token stays in the router or who it pays
+      `PERMIT2_PERMIT_BATCH`, lets its spender take, steps, deadline, and unless
-      is unknown (see Transaction Decoding)
+      a swap pays only the From address, a `Paid to` line for each other address
      it pays, or saying that a token stays in the router or who it pays is
      unknown (see Transaction Decoding)
    - A line under each token of the decoded action: "Blockscout's report of
      your balances is not used to name this token, because "Use Blockscout" is
      off in Settings." While "Use Blockscout" is off, the line shows when the
      bundled list and the tracked tokens lack the token's name or decimals.
      While the setting is on, Blockscout's report of the user's balances is a
      third source of a token's name and decimals (see Unknown token scale).
    - From: color dot + full address + etherscan link
    - Contract: color dot + full address + etherscan link, token symbol label if
      known; for a contract creation, the same sentence as on WaitTx
@@ -2463,7 +2689,10 @@ view would leave a wallet one click from deletion.
      the site puts in the message, except a `Permit`'s token, which is the
      domain's `verifyingContract`; any those fields do not give is shown as
      `Unknown`, and the domain, type and message lines still follow. Only typed
-      data that cannot be read at all is shown as raw text.
+      data that cannot be read at all is shown as raw text. A token gets the
      same line under it as on TxApproval, whenever TxApproval would show that
      line. As there, Blockscout's report of the user's balances is a source of
      a token's name and decimals only while "Use Blockscout" is on.
    - Raw data (`personal_sign` and `eth_sign`): the message's hex exactly as
      the site sent it. The bytes it encodes are what is signed, as an EIP-191
      personal message.
@@ -2593,16 +2822,36 @@ view would leave a wallet one click from deletion.
 ### External Services
-AutistMask is not a fully self-contained offline tool. It necessarily
+AutistMask is not a fully self-contained offline tool. By default it sends the
-communicates with three external services to function as a wallet:
+user's data only to the Ethereum RPC endpoint. It also asks the CoinDesk price
 API for prices, sending token symbols and nothing else.
 Two more services are sent none of the user's data until the user turns on a
 setting for each:
 - Blockscout, with "Use Blockscout"
 - Etherscan, with "Check recipients on Etherscan"
 Both settings are off in a new install. Welcome and Settings both offer them.
 Each setting applies to every network.
 Before each request that sends the user's data to Blockscout or Etherscan, the
 wallet reads that service's setting from storage. The wallet reads the setting
 again when the answer lands. While the setting is off, no such request is made,
 and an answer that lands after the setting went off is dropped.
 Contacted by default:
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
-  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
  them the balance of every tracked token at every address (`balanceOf`),
  estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
  broadcast transactions (`eth_sendRawTransaction`), and check transaction
-  receipts. The default endpoint is a public RPC (configurable by the user to
+  receipts. Every ENS lookup is made through the RPC endpoint alone. So a name
-  any endpoint they prefer, including a local node). By default the extension
+  does not resolve when its resolver says the name is resolved off-chain. The
-  talks to `https://ethereum-rpc.publicnode.com`.
+  default endpoint is a public RPC (configurable by the user to any endpoint
  they prefer, including a local node). By default the extension talks to
  `https://ethereum-rpc.publicnode.com`.
    - **Data sent**: Ethereum addresses, transaction data, contract call
      parameters. The RPC endpoint can see all on-chain queries and submitted
      transactions.
@@ -2614,13 +2863,44 @@ communicates with three external services to function as a wallet:
    - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
      addresses or user-specific data.
- **Blockscout block-explorer API**: Used to fetch transaction history (normal
+Sent the user's data only while its setting is on:
-  transactions and ERC-20 token transfers), ERC-20 token balances, and token
+
-  holder counts (for spam filtering). The default endpoint is
+- **Blockscout block-explorer API** ("Use Blockscout"): The default endpoint is
  `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
-    - **Data sent**: Ethereum addresses. Blockscout receives the user's
+    - **Used for**:
-      addresses to query their transaction history and token balances. No
+        - transaction history (normal transactions and ERC-20 token transfers),
-      private keys, passwords, or signing operations are sent.
+          for Home, AddressDetail and AddressToken
        - the balances of the ERC-20 tokens the user has not tracked, for Home,
          AddressDetail, Send and DeleteAddress
        - the names and decimals of those tokens, for TxApproval, SignApproval,
          WaitTx, SuccessTx and ErrorTx
        - token holder counts, for spam filtering
        - a transaction's block, network details and calldata, for
          TransactionDetail
    - **Contacted**, while the setting is on:
        - on every balance refresh, in the popup and in the background
        - when Home, AddressDetail or AddressToken loads its history
        - when TransactionDetail opens
    - **While the setting is off**: Each screen that would show Blockscout's
      data says instead that the setting is off. Only tracked tokens are listed.
    - **Saving the URL**: pressing "Save" beside the URL in Settings asks that
      URL for `/stats`, whether or not the setting is on. This request carries
      no user data.
    - **Data sent**: Ethereum addresses, and the hash of each transaction the
      user opens. Blockscout receives the user's addresses to query their
      transaction history and token balances. No private keys, passwords, or
      signing operations are sent.
 - **Etherscan address labels** ("Check recipients on Etherscan"): While the
  setting is on, ConfirmTx looks up the recipient's address on Etherscan each
  time the screen is shown. The lookup checks for a phishing or scam label,
  best-effort. This is a direct page fetch with no API key; the user's browser
  makes the request. While the setting is off, ConfirmTx says that no Etherscan
  check was made.
    - **Data sent**: the recipient's address and nothing else.
 The etherscan links on the screens open a page in the browser when the user
 clicks one. They are not requests the wallet makes.
 What the extension does NOT do:
@@ -2629,16 +2909,9 @@ What the extension does NOT do:
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
-In addition to the three user-configurable services above (RPC endpoint,
+Users who want maximum privacy can point the RPC URL at their own node. With
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
+"Use Blockscout" on, they can point the Blockscout URL at their own instance
-
+too.
 - **Etherscan address labels**: When confirming a transaction, the extension
  performs a best-effort lookup of the recipient address on Etherscan to check
  for phishing/scam labels. This is a direct page fetch with no API key; the
  user's browser makes the request.
 Users who want maximum privacy can point the RPC and Blockscout URLs at their
 own self-hosted instances (price fetching can be disabled in a future version).
 ### Dependencies
@@ -2820,8 +3093,11 @@ logged.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
- View ERC-20 token balances (tokens on the bundled known-token list, tokens
+- View ERC-20 token balances:
-  with 1,000 or more holders, and tokens the user adds by contract address)
+    - tokens the user adds by contract address
    - while "Use Blockscout" is on, tokens on the bundled known-token list and
      tokens with 1,000 or more holders
 - View transaction history and transaction details, while "Use Blockscout" is on
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)
@@ -3136,8 +3412,9 @@ Currently supported:
  `Min. paid out`, because the swap's minimum includes the fee. The minimum
  reads `Min. received` only when some step pays the transaction's sender (the
  From address on TxApproval, the sender the explorer reports on
-  TransactionDetail) and no `Paid to` line is shown. `Paid to` lines after
+  TransactionDetail), no `Paid to` line is shown, and no permit or batch grants
-  `Token Out` name each other address paid; one reads
+  an allowance to a spender other than the router (see below). `Paid to` lines
  after `Token Out` name each other address paid; one reads
  `The bridge, which pays the deposit's recipient on another network` for a
  bridge deposit; one reads, for example,
  `The router, 2000.0000 USDT from the sender (later steps may not spend all of it)`
@@ -3172,38 +3449,57 @@ Currently supported:
  added to the total while both are quantities: a V3 exact-in of 600 USDT and a
  V2 exact-in of 400 USDT, both paid by the user, read `1000.0000 USDT`. When
  the decoder does not know a take's amount, the total is not known and there is
-  no `Amount` line. `Token In` is the token of the last `PERMIT2_PERMIT` the
+  no `Amount` line. A `PERMIT2_PERMIT` names `Token In` only when its amount,
-  decoder reads, when there is one. Its amount, `Unlimited` included, stands as
+  `Unlimited` included, stands as the `Amount` figure in place of the total,
-  the `Amount` figure in place of the total only in the plain shape of Uniswap's
+  which it does only in the plain shape of Uniswap's own routes: it comes before
-  own routes: it is the only `PERMIT2_PERMIT`, its spender is the router, the
+  the step that sets the input side, it is the only `PERMIT2_PERMIT` in the
-  router may not let it fail, no step before it takes its token or a token the
+  transaction and there is no `PERMIT2_PERMIT_BATCH`, its spender is the router,
-  decoder does not know, and the decoder reads every step after it in full.
+  the router may not let it fail, no step before it takes its token, a
-  Permit2 then lets the router take no more of the token than that amount, so
+  `PERMIT2_TRANSFER_FROM` of it included, or a token the decoder does not know,
-  the permit covers every take of it. A step the decoder does not read in full
+  and the decoder reads every step after it in full. Permit2 then lets the
-  may raise what Permit2 lets the router take, as a `PERMIT2_PERMIT_BATCH` can:
+  router take no more of the token than that amount, so the permit covers every
-  a command the decoder does not read (listed at the end of this section), a
+  take of it. A step before the permit takes under whatever allowance the router
-  step whose input it cannot read, in whole or in part, and a step it fails on.
+  already had, so it may take more than the permit's amount, which would then
-  In any other case the line gives the total, as with no permit. When the step
+  read lower than what leaves the user's wallet: a `PERMIT2_TRANSFER_FROM` of
-  that sets the input side spends a token other than the permit's, or one the
+  2,000 USDT into the router, then a permit of 600 USDT to the router and a V3
-  decoder does not know, its amount gets lines of its own, unless it states no
+  exact-in of 2,000 USDT paid from the router, read `Amount 2000.0000 USDT`. A
-  amount and the user pays it none of its input token, and the total has no
+  later permit or batch may raise what Permit2 lets the router take, and so may
-  figure to start from: unless the permit's amount stands there is no `Amount`
+  a step the decoder does not read in full: a command the decoder does not read
-  line, and each take of the permit's token gets lines of its own. Each take the
+  (listed at the end of this section), a step whose input it cannot read, in
-  total does not count gives three lines after the `Amount` line (after
+  whole or in part, and a step it fails on. Every other `PERMIT2_PERMIT`, before
-  `Token In` when there is none): one of a token other than `Token In`; one of
+  the step that sets the input side or after it, leaves `Token In` and the
-  `Token In` after an amount that is not a quantity (a V4 open delta,
+  `Amount` line as they read with no permit, unless it lets a spender other than
-  `ALREADY_PAID`, which keep their wording on the `Amount` line, or no stated
+  the router take `Token In` (see below): a permit of 5,000 DAI to another
-  amount, as of a V4 exact-out step); and one whose amount the decoder does not
+  address and then a V3 exact-in of 600 USDT read `Swap USDT → USDC` with
-  know. When the step that sets the input side states no amount, the user pays
+  `Amount 600.0000 USDT`, and so do that exact-in and then a permit of 5,000 DAI
-  it some of its input token, and there is no `Amount` line, that step gets them
+  to the router. When a permit's amount stands and the step that sets the input
-  too whenever another take's lines give a figure, or a `PERMIT2_TRANSFER_FROM`
+  side spends a token other than the permit's, or one the decoder does not know,
-  of its token gives one, on the lines below or, into the router, on its
+  that step's amount gets lines of its own, unless it states no amount and the
-  `Paid to` line, so that figure cannot read as all that leaves. When it states
+  user pays it none of its input token. Each take the total does not count gives
-  no amount and the user pays it none of its input token, as when the router
+  three lines after the `Amount` line (after `Token In` when there is none): one
-  pays it, that step takes none of that token from the user's wallet and never
+  of a token other than `Token In`; one of `Token In` after an amount that is
-  gets them, with a permit or without. They come in step order, the step that
+  not a quantity (a V4 open delta, `ALREADY_PAID`, which keep their wording on
-  sets the input side first when it has them: `Moved from the sender`, its
+  the `Amount` line, or no stated amount, as of a V4 exact-out step); and one
-  amount, worded as the `Amount` line words one, or
+  whose amount the decoder does not know. When there is no `Amount` line, each
  take the total counts gets them too, so that every amount the decoder reads is
  shown: the amount the step that sets the input side states, when it is a
  quantity and the user pays that step (a V2 or V3 step whose `payerIsUser` is
  true, a V4 step the user pays some of its input token, or a `WRAP_ETH`, whose
  ETH comes from the transaction's value), and each later take of `Token In`
  added to it. A step that sets the input side and is paid from the router takes
  nothing from the user's wallet and gets none. A `PERMIT2_PERMIT` the decoder
  cannot read, then V3 exact-ins of 600 USDT and 400 DAI paid by the user, give
  lines for both amounts. When the step that sets the input side states no
  amount, the user pays it some of its input token, and there is no `Amount`
  line, that step gets them too whenever another take's lines give a figure, or
  a `PERMIT2_TRANSFER_FROM` of its token gives one, on the lines below or, into
  the router, on its `Paid to` line, so that figure cannot read as all that
  leaves. When it states no amount and the user pays it none of its input token,
  as when the router pays it, that step takes none of that token from the user's
  wallet and never gets them, with a permit or without. They come in step order,
  except that the step that sets the input side comes first when it has them,
  followed, when there is no `Amount` line, by the other takes the total counts:
  `Moved from the sender`, its amount, worded as the `Amount` line words one, or
  `Unknown (could not be decoded)` when the decoder does not know it;
  `Token moved`, giving the token's address as the `Token In` line does; and
  `Moved to`, which reads `The swap step that spends it`. A token the decoder
@@ -3226,11 +3522,34 @@ Currently supported:
  on every router but `UniversalRouterV1`, and otherwise gives the address. A
  move into the router needs none of them, because its `Paid to` line and
  `Token moved into the router` line already give the amount, the token and
-  where it goes, and so its amount is shown once. These lines change neither the
+  where it goes, and so its amount is shown once. Every `PERMIT2_PERMIT` whose
-  `Paid to` lines nor the minimum's label. A step goes unread when its recipient
+  amount does not stand as the `Amount` figure, before the step that sets the
-  does not decode as an address, when it is a V3 swap step whose path is shorter
+  input side or after it, gives three lines, in step order, after those for each
-  than one token address or has bytes after its last hop, or when it is a
+  `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
-  command the decoder does not read: every command other than `PERMIT2_PERMIT`,
+  `5000.0000 DAI`, or `Unlimited` for Permit2's maximum; `Allowance token`,
  giving the token's address as the `Token In` line does; and
  `Allowance spender`, the address it lets take the token. Only a permit whose
  amount stands gives none: the `Amount` line gives its amount, `Token In` its
  token, and its spender is the router. Each allowance a `PERMIT2_PERMIT_BATCH`
  grants, one for each token it names, all for its one spender, gives the same
  three lines, in step order with those of each `PERMIT2_PERMIT`. A
  `PERMIT2_PERMIT` or `PERMIT2_PERMIT_BATCH` whose input the decoder cannot
  read, such as one whose token or spender word has a nonzero top byte, may let
  any spender take any amount of any token: it gives one `Permit2 allowance`
  line alone, reading `Unknown (could not be decoded)`. These lines change no
  `Paid to` line: a permit or batch pays nobody. But code that a step runs, such
  as a V4 pool's hook or a token's own code, can call a spender other than the
  router, which can then take up to its allowance from the user's wallet before
  the transaction ends. So an allowance to any spender but the router, or a
  permit or batch the decoder cannot read, makes the minimum read
  `Min. paid out`, and when its token is `Token In`, or the decoder does not
  know its token or `Token In`, it leaves no `Amount` line, whose figure might
  be too low: a permit of 5,000 USDT to another address and then a V3 exact-in
  of 600 USDT read with no `Amount` line, and the 600 USDT gets lines of its
  own. A step goes unread when its recipient does not decode as an address, when
  it is a V3 swap step whose path is shorter than one token address or has bytes
  after its last hop, or when it is a command the decoder does not read: every
  command other than `PERMIT2_PERMIT`, `PERMIT2_PERMIT_BATCH`,
  `PERMIT2_TRANSFER_FROM`, `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`,
  `V3_SWAP_EXACT_IN`, `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`,
  `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`,
@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
- **No third-party token list APIs.** Token balances come from the same block
+- **No third-party token list APIs.** The balances of the tokens you track are
-  explorer you configure for transaction history, and the extension ships its
+  read from your RPC endpoint. While "Use Blockscout" is on, the other tokens
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
+  come from the same block explorer you configure for transaction history. The
-  detection. Any token you want tracked across all your addresses, you add
+  extension ships its own hardcoded list of top ERC-20 contract addresses for
-  yourself by contract address.
+  symbol-spoofing detection. Any token you want tracked across all your
  addresses, you add yourself by contract address.
 - **No backend servers operated by the developer.** Nothing is sent to any
  server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,13 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
+not have a backend server. Out of the box it sends your data only to the
-three you configure yourself, and two fixed ones used for scam detection.
+Ethereum RPC endpoint. It also asks the CoinDesk price API for prices, sending
 token symbols and nothing else.
 Blockscout and Etherscan are sent none of your data until you turn on a setting
 for each. The settings are "Use Blockscout" and "Check recipients on Etherscan".
 Both are off in a new install. Welcome and Settings both offer them.
 ### External Services
@@ -83,11 +89,14 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
-When it is contacted: on every balance refresh (every 10 seconds while the popup
+When it is contacted:
-is open, every 60 seconds in the background), when you type an ENS name into the
+
-Send screen, when a send is prepared and broadcast, while a pending transaction
+- on every balance refresh (every 10 seconds while the popup is open, every 60
-is polled for its receipt, and for the reverse ENS lookups used to label
+  seconds in the background)
-addresses (cached for 12 hours).
+- when you review a send to an ENS name
 - when a send is prepared and broadcast
 - while a pending transaction is polled for its receipt
 - for the reverse ENS lookups used to label addresses (cached for 12 hours)
 What gets sent: standard Ethereum JSON-RPC requests (balance queries,
 transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
@@ -96,16 +105,31 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
-Used to fetch token balances and transaction history. Blockscout is an
+Blockscout is an open-source blockchain explorer. AutistMask sends it your data
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
+only while "Use Blockscout" is on. AutistMask then asks Blockscout for:
 balances (including the holder counts used for spam filtering) and your recent
 transactions and token transfers. You can change this in Settings to a
 self-hosted Blockscout instance.
-When it is contacted: on every balance refresh, and whenever a screen showing
+- your recent transactions and token transfers
-transaction history is opened.
+- the balances of the tokens you have not tracked, with the holder counts used
  for spam filtering
 - the block, fees and calldata of a transaction you open
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+You can change the endpoint in Settings to a self-hosted Blockscout instance.
 While the setting is off, each screen that would show Blockscout's data says
 instead that the setting is off. Only the tokens you track are listed. When you
 turn the setting off, every other token leaves the lists at once.
 When it is contacted, while "Use Blockscout" is on:
 - on every balance refresh
 - whenever a screen showing transaction history is opened
 - when you open a transaction
 Pressing "Save" beside the Blockscout URL in Settings checks the URL by asking
 it for `/stats`. That happens whether or not the setting is on. The request
 sends none of your data.
 What gets sent: your Ethereum addresses (to look up balances and transactions)
 and the hash of each transaction you open.
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
@@ -122,16 +146,21 @@ address.
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
-When you review a send, AutistMask fetches the recipient's public Etherscan
+While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
+public Etherscan address page when you review a send. AutistMask looks for a
-warning, and shows a red warning if it finds one. This is a plain page fetch
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
-with no API key, made by your browser. It is best-effort: if it fails, it is
+it finds one. This is a plain page fetch with no API key, made by your browser.
-silently ignored. This endpoint is not user-configurable.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
 user-configurable.
-When it is contacted: each time you reach the send confirmation screen.
+The setting is off in a new install. While it is off, the confirmation screen
 says that no Etherscan check was made.
-What gets sent: the recipient address you are about to send to, and your IP
+When it is contacted: only while "Check recipients on Etherscan" is on, each
-address. Your own addresses are not sent.
+time you reach the send confirmation screen.
 What gets sent: the recipient's address and nothing else. As with any request,
 Etherscan sees your IP address.
 Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
 contracts) are ordinary links. They contact nothing until you click them.
@@ -185,6 +214,9 @@ password.
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
   On first use, the screen with "Add wallet" also offers "Use Blockscout" and
   "Check recipients on Etherscan", both off. External Services above says what
   each one does. You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
   recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +252,14 @@ always produce the same sequence of addresses.
 ### Adding ERC-20 Tokens
-Tokens you hold show up automatically only if they are in the extension's
+The wallet looks for tokens you hold only while "Use Blockscout" is on. Even
-bundled list of well-known tokens or have at least 1,000 holders; everything
+then, a token shows up only if it is in the extension's bundled list of
-else is treated as spam and hidden. To track a token explicitly (which also
+well-known tokens or has at least 1,000 holders. Everything else is treated as
-shows it at zero balance), add it by contract address:
+spam and hidden.
 The wallet shows every token you track, whether or not "Use Blockscout" is on.
 By default a tracked token is shown at zero balance too (see Display in
 Settings). To track a token, add it by contract address:
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -239,7 +275,9 @@ screen. Tokens can also be added from Settings, under "Tracked Tokens".
 1. Click "Send" from the home screen or an address detail view.
 2. Select what to send (ETH, or any ERC-20 token with a balance on this address
   that survives the spam filters).
-3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
+3. Enter the recipient address or ENS name (e.g. `vitalik.eth`). AutistMask does
   not look up a name resolved off-chain. For such a name, enter the address
   instead.
 4. Enter the amount, or click "Max" to fill it in: a token's balance, cut to 18
   decimal places, or your ETH balance minus the amount reserved for the network
   fee.
@@ -389,8 +427,9 @@ Click the gear icon on the home screen to access settings:
  that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
  You can use your own node for maximum privacy.
- **Blockscout API**: Change the Blockscout instance used for token balances and
+- **Blockscout API**: the "Use Blockscout" checkbox, off until you tick it, and
-  transaction history. You can use a self-hosted instance.
+  the URL of the Blockscout instance. You can use a self-hosted instance.
 - **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
  transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
@@ -13,6 +13,11 @@
        "fmt": "prettier --write .",
        "fmt-check": "prettier --check ."
    },
    "jest": {
        "setupFiles": [
            "<rootDir>/tests/support/navigatorLocks.js"
        ]
    },
    "devDependencies": {
        "@eslint/js": "10.0.1",
        "@tailwindcss/cli": "4.3.1",
@@ -17,7 +17,11 @@ const { applyChainSwitchFields } = require("../shared/chainSwitchFields");
 // the same prohibition reported early, not the guarantee.
 const { getState, updateState } = require("./state");
 const { StateUnusableError } = require("../shared/stateSchema");
-const { refreshBalances, getProvider } = require("../shared/balances");
+const {
    refreshBalances,
    dropUntrackedTokens,
    getProvider,
 } = require("../shared/balances");
 const { debugFetch, log } = require("../shared/log");
 const {
    verifySignedTx,
@@ -1379,6 +1383,17 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // balances that came back — by address, onto whatever storage holds NOW.
 // Applying by address rather than writing the array back is what keeps a
 // wallet or address added, renamed or deleted during the round trip.
 //
 // Nothing is applied when the network stored NOW is not the one the refresh
 // ran on. A network switch during the round trip cleared every address's
 // balances (applyChainSwitchFields()), and the previous network's must not come
 // back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
 // lastBalanceRefresh is left as the switch set it, so the next tick refreshes
 // the new network.
 //
 // Blockscout may have answered just before the user turned "Use Blockscout"
 // off. So the save reads the stored setting again, and drops every token the
 // user has not tracked if the setting is off.
 async function backgroundRefresh() {
    const s = await getState();
    const now = Date.now();
@@ -1402,6 +1417,7 @@ async function backgroundRefresh() {
    }
    await updateState((fresh) => {
        if (fresh.networkId !== s.networkId) return;
        for (const wallet of fresh.wallets) {
            for (const addr of wallet.addresses || []) {
                const got = refreshed.get(String(addr.address).toLowerCase());
@@ -1415,6 +1431,9 @@ async function backgroundRefresh() {
                }
            }
        }
        if (!fresh.useBlockscout) {
            dropUntrackedTokens(fresh.wallets, fresh.trackedTokens);
        }
        fresh.lastBalanceRefresh = now;
    });
 }
@@ -16,17 +16,20 @@
 //                     across any number of awaits and no concurrent work can
 //                     move it.
 //   updateState(fn)   read fresh, apply fn to that fresh record, write it
-//                     back — all inside a queue, so two background writes
+//                     back — all holding the lock every write of the stored
-//                     never interleave, and the read is one storage round trip
+//                     record takes, so no other write lands in between, by
-//                     ahead of the write rather than a page lifetime ahead of
+//                     the background or by any page except a page in a
-//                     it (which is what made the popup's saveState() need a
+//                     Firefox private window (README, "Stored state and its
 //                     version"). The read is one storage round trip ahead of
 //                     the write rather than a page lifetime ahead of it
 //                     (which is what made the popup's saveState() need a
 //                     per-field merge against a baseline at all).
 //
 // A handler that must both read and write therefore does its network work
 // against a snapshot it owns, and applies the RESULT inside updateState().
 // It never publishes an object other in-flight work is holding.
-const { storageGet, storageSet } = require("../shared/browserApi");
+const { storageGet, storageSet, withLock } = require("../shared/browserApi");
 const { normalizePersisted } = require("../shared/persistedState");
 const {
    STATE_SCHEMA_VERSION,
@@ -51,11 +54,6 @@ async function getState() {
    return normalizePersisted(result.autistmask);
 }
 // Serializes the read-modify-write turns below. Two of them interleaved would
 // each read before the other wrote, and the second write would carry the first
 // one's fields back to their pre-turn values.
 let updateQueue = Promise.resolve();
 async function updateStateOnce(mutate) {
    const s = await getState();
    await mutate(s);
@@ -70,27 +68,22 @@ async function updateStateOnce(mutate) {
 // Apply `mutate` to a record read fresh from storage and write the result
 // back. `mutate` receives a detached, normalized profile and mutates it in
-// place; it may be async, but it must not do anything slow — the window
+// place; it may be async, but it must not do anything slow. The write is the
-// between the read and the write is the window in which another context's
+// WHOLE record, which is safe only because the lock (withLock() in
-// write is lost, and keeping it to one storage round trip is what makes a
+// src/shared/browserApi.js) is held from the read to the write: two
-// whole-record write safe here. Concretely: the write is the WHOLE record, so
+// background turns, or a turn and a page's save, never interleave
-// a popup write that lands inside that window is reverted, in every field, by
+// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every page's save waits
-// the record this turn read before it. That is accepted because the window is
+// while it is held, except a page in a Firefox private window, which Firefox
-// one round trip long and the popup is not writing while the worker is;
+// gives locks of its own (README, "Stored state and its version").
 // widening it is what would make it a real hazard.
 //
 // `mutate` must also not call updateState() itself, directly or through
-// anything it awaits: the queue is strictly serial, so the inner turn waits on
+// anything it awaits: the inner turn waits for the lock the outer one holds,
-// the outer one, which is waiting on the inner one. That deadlocks the whole
+// and the outer one is waiting on the inner one. That deadlocks every write of
-// background, not just the caller. Mutate the record you were handed.
+// the stored record, not just the caller. Mutate the record you were handed.
 //
 // Resolves with the record that was written.
 function updateState(mutate) {
-    const turn = updateQueue.then(() => updateStateOnce(mutate));
+    return withLock("autistmask", () => updateStateOnce(mutate));
    // The queue must advance even when a turn rejects, or every update after
    // it queues behind a promise that never settles.
    updateQueue = turn.catch(() => {});
    return turn;
 }
 module.exports = { getState, updateState };
@@ -43,6 +43,38 @@
            <!-- ============ WELCOME / FIRST USE ============ -->
            <div id="view-welcome" class="view hidden">
                <p class="mb-3">Welcome! To get started, add a wallet.</p>
                <div class="bg-well p-3 mx-1 mb-3">
                    <p class="text-xs mb-2">
                        This wallet sends your data only to the Ethereum RPC
                        endpoint, unless you turn on one of these. You can
                        change them later in Settings.
                    </p>
                    <label
                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
                    >
                        <input type="checkbox" id="welcome-use-blockscout" />
                        Use Blockscout
                    </label>
                    <p class="text-xs text-muted mb-2">
                        Shows transaction history, transaction details and the
                        tokens you have not tracked. Sends your addresses, and
                        the hash of each transaction you open, to the Blockscout
                        API.
                    </p>
                    <label
                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
                    >
                        <input
                            type="checkbox"
                            id="welcome-check-recipients-on-etherscan"
                        />
                        Check recipients on Etherscan
                    </label>
                    <p class="text-xs text-muted">
                        Sends each recipient's address to Etherscan to check it
                        for a phishing or scam label.
                    </p>
                </div>
                <button
                    id="btn-welcome-add"
                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
@@ -90,7 +122,7 @@
                <div id="add-wallet-section-mnemonic">
                    <!-- The die button shares the instruction's row: on a row
                         of its own it pushes Import below the fold at
-                         360x600. -->
+                         396x600. -->
                    <div class="mb-2 flex justify-between items-start gap-2">
                        <p>
                            Enter your 12 or 24 word recovery phrase below, or
@@ -212,7 +244,7 @@
                    />
                </div>
                <!-- The error line sits beside Import, not above it: at
-                     360x600 the button already starts near the bottom of
+                     396x600 the button already starts near the bottom of
                     the popup, and a line of its own would push it below
                     the fold. The longest error fits on one line here. -->
                <div class="flex items-center gap-2">
@@ -272,6 +304,10 @@
                <!-- wallet list -->
                <div id="wallet-list"></div>
                <p id="home-tokens-note" class="text-xs text-muted py-1 hidden">
                    Only tracked tokens are listed, because "Use Blockscout" is
                    off in Settings.
                </p>
                <!-- recent transactions across all addresses -->
                <div>
@@ -336,6 +372,13 @@
                    <div id="address-balances" class="min-h-[1.25rem]">
                        &nbsp;
                    </div>
                    <p
                        id="address-tokens-note"
                        class="text-xs text-muted hidden"
                    >
                        Only tracked tokens are listed, because "Use Blockscout"
                        is off in Settings.
                    </p>
                </div>
                <!-- actions -->
@@ -526,12 +569,23 @@
                </div>
                <div class="mb-2">
                    <label class="block mb-1">What to send</label>
-                    <select
+                    <!-- The token dropdown and the line under it. Both are
-                        id="send-token"
+                    hidden when AddressToken opens Send for its own token. -->
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                    <div id="send-token-dropdown">
-                    >
+                        <select
-                        <option value="ETH">ETH</option>
+                            id="send-token"
-                    </select>
+                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
                        >
                            <option value="ETH">ETH</option>
                        </select>
                        <p
                            id="send-tokens-note"
                            class="text-xs text-muted hidden"
                        >
                            Only tracked tokens are listed, because "Use
                            Blockscout" is off in Settings.
                        </p>
                    </div>
                    <div id="send-token-static" class="text-sm hidden"></div>
                </div>
                <div class="mb-2">
@@ -660,6 +714,13 @@
                        phishing/scam. Do not send funds to this address.
                    </div>
                </div>
                <p
                    id="confirm-etherscan-note"
                    class="mb-2 text-xs text-muted hidden"
                >
                    This address was not checked on Etherscan, because "Check
                    recipients on Etherscan" is off in Settings.
                </p>
                <div
                    id="confirm-errors"
                    class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
@@ -750,6 +811,7 @@
                <div class="mb-3">
                    <div class="text-xs text-muted mb-1">Amount</div>
                    <div id="wait-tx-summary" class="font-bold"></div>
                    <div id="wait-tx-token-note"></div>
                </div>
                <div class="mb-3">
                    <div class="text-xs text-muted mb-1">To</div>
@@ -796,6 +858,7 @@
                <div class="mb-3">
                    <div class="text-xs text-muted mb-1">Amount</div>
                    <div id="error-tx-summary" class="font-bold"></div>
                    <div id="error-tx-token-note"></div>
                </div>
                <div class="mb-3">
                    <div class="text-xs text-muted mb-1">To</div>
@@ -1002,8 +1065,19 @@
                <div class="bg-well p-3 mx-1 mb-3">
                    <h3 class="font-bold mb-1">Blockscout API</h3>
                    <label
                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
                    >
                        <input type="checkbox" id="settings-use-blockscout" />
                        Use Blockscout
                    </label>
                    <p class="text-xs text-muted mb-2">
                        Shows transaction history, transaction details and the
                        tokens you have not tracked. Sends your addresses, and
                        the hash of each transaction you open, to the Blockscout
                        API below.
                    </p>
                    <p class="text-xs text-muted mb-1">
                        Used to fetch token balances and transaction history.
                        Change this if you run your own Blockscout instance.
                    </p>
                    <input
@@ -1019,6 +1093,23 @@
                    </button>
                </div>
                <div class="bg-well p-3 mx-1 mb-3">
                    <h3 class="font-bold mb-1">Etherscan</h3>
                    <label
                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
                    >
                        <input
                            type="checkbox"
                            id="settings-check-recipients-on-etherscan"
                        />
                        Check recipients on Etherscan
                    </label>
                    <p class="text-xs text-muted">
                        Sends each recipient's address to Etherscan to check it
                        for a phishing or scam label.
                    </p>
                </div>
                <div class="bg-well p-3 mx-1 mb-3">
                    <h3 class="font-bold mb-1">Token Spam Protection</h3>
                    <p class="text-xs text-muted mb-2">
@@ -1291,6 +1382,13 @@
                >
                    &nbsp;
                </div>
                <p
                    id="delete-address-tokens-note"
                    class="text-xs text-muted mb-2 hidden"
                >
                    Only tracked tokens are listed, because "Use Blockscout" is
                    off in Settings.
                </p>
                <p class="text-xs text-muted mb-3">
                    A wallet always keeps at least one address. To remove the
                    last one, delete the whole wallet from Settings instead.
@@ -1504,6 +1602,16 @@
                    </div>
                </div>
                <!-- Shown in place of the block, decoded details, network
                details and raw data, which only Blockscout gives. -->
                <p
                    id="tx-detail-blockscout-note"
                    class="text-xs text-muted mx-1 mb-3 hidden"
                >
                    This screen shows no block, decoded details, network details
                    or raw data, because "Use Blockscout" is off in Settings.
                </p>
                <!-- ── Decoded details ── -->
                <div id="tx-detail-calldata-section" class="hidden">
                    <div class="bg-well p-3 mx-1 mb-3">
@@ -5,12 +5,14 @@ const {
    state,
    saveState,
    onSaveFailure,
    takeStoredNetwork,
    loadState,
 } = require("../shared/state");
 const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
-const { refreshBalances } = require("../shared/balances");
+const { refreshBalances, dropUntrackedTokens } = require("../shared/balances");
 const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
    $,
    showView,
@@ -22,6 +24,7 @@ const {
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 const {
    onStorageChanged,
    tabsGetCurrent,
    tabsGetZoom,
    windowsGetCurrent,
@@ -68,23 +71,65 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 // The refresh first takes the stored network, "Use Blockscout" and "Check
 // recipients on Etherscan" (followStoredSettings() below). So the screens it
 // draws reflect any change saved elsewhere.
 //
 // The refresh writes into a copy of the wallets. Inside the save, under the
 // lock, its results are copied onto the address records in `state` only if the
 // network it ran on is still the active one, on this page and in the stored
 // record; the background's switch, after the user approves a site's request,
 // reaches this page only after the stored record (followStoredSettings()).
 // A switch while the refresh ran cleared every address's balances
 // (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
 // previous network's must not come back over them
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
 // recorded as done. Results are copied by address, so an address added or
 // removed meanwhile is left as it is. Blockscout may have answered before the
 // user turned "Use Blockscout" off. So the save drops every token the user has
 // not tracked if the stored setting is off by then.
 async function doRefreshAndRender() {
    if (refreshInFlight) return;
    refreshInFlight = true;
    try {
        await followStoredSettings();
        const networkId = state.networkId;
        const wallets = structuredClone(state.wallets);
        await Promise.all([
            refreshPrices(),
            refreshBalances(
-                state.wallets,
+                wallets,
                state.rpcUrl,
                state.blockscoutUrl,
                state.trackedTokens,
-                state.networkId,
+                networkId,
                pageClosed.signal,
            ),
        ]);
-        state.lastBalanceRefresh = Date.now();
+        const refreshed = new Map();
-        await saveState();
+        for (const wallet of wallets) {
            for (const addr of wallet.addresses) {
                refreshed.set(addr.address, addr);
            }
        }
        await saveState((stored) => {
            if (state.networkId !== networkId) return false;
            if (stored.networkId !== networkId) return false;
            for (const wallet of state.wallets) {
                for (const addr of wallet.addresses) {
                    const got = refreshed.get(addr.address);
                    if (!got) continue;
                    for (const key of ["balance", "ensName", "tokenBalances"]) {
                        if (got[key] !== undefined) addr[key] = got[key];
                    }
                }
            }
            if (!stored.useBlockscout) {
                dropUntrackedTokens(state.wallets, stored.trackedTokens);
            }
            state.lastBalanceRefresh = Date.now();
            return true;
        });
        renderWalletList();
    } catch (e) {
        // Every call site fires this and walks away — the boot below, the ten
@@ -116,6 +161,7 @@ const ctx = {
    renderWalletList,
    doRefreshAndRender,
    startRefresh,
    restoreView,
    pageClosed: pageClosed.signal,
    showAddWalletView: () => {
        pushCurrentView();
@@ -183,6 +229,47 @@ function fallbackView() {
    showView("main");
 }
 // When the background saves a network switch, once the user approves a site's
 // request, or another popup page saves one, this page follows the stored
 // record. It takes the network the record names as a save reads it, holding
 // the lock, so no later save of this page writes the previous network back, and
 // then leaves the page as a switch in Settings leaves it. This page's own
 // switch in Settings is made under the lock as well (onChainSwitch() in
 // src/shared/chainSwitch.js), so a record naming a network other than this
 // page's always holds a switch saved elsewhere, and a switch the user picks
 // here while this waits for the lock is made after it.
 //
 // Another page may change "Use Blockscout" or "Check recipients on Etherscan".
 // This page takes either change the same way and draws its screens again. This
 // page's own changes to the two settings are made under the lock too
 // (views/settings.js, views/welcome.js).
 async function followStoredSettings() {
    let changed = false;
    // A failed save is reported by saveState() itself: see onSaveFailure().
    await saveState((stored) => {
        if (stored.networkId !== state.networkId) {
            settings.cutViewStack();
            takeStoredNetwork(stored);
            clearPopupCaches();
            changed = true;
        }
        if (stored.useBlockscout !== state.useBlockscout) {
            settings.setUseBlockscout(stored.useBlockscout);
            changed = true;
        }
        if (
            stored.checkRecipientsOnEtherscan !==
            state.checkRecipientsOnEtherscan
        ) {
            state.checkRecipientsOnEtherscan =
                stored.checkRecipientsOnEtherscan;
            changed = true;
        }
        if (!changed) return false;
    }).catch(() => {});
    if (changed) settings.showNewSettings();
 }
 // The background opens the approval window as wide as the page, but the
 // browser counts the window's frame in that width, and a screen taller than
 // the window takes a vertical scrollbar out of it too. So once the screen is
@@ -220,7 +307,7 @@ async function widenApprovalWindow() {
 async function init() {
    // First, before anything can save: showView() saves on every navigation
    // without awaiting, so a save that fails from here on has somewhere to be
-    // reported rather than being swallowed by the save queue
+    // reported rather than reaching only the console
    // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
    // the approval-window branch below too, since that window saves as well.
    //
@@ -327,8 +414,27 @@ async function init() {
    settingsAddToken.init(ctx);
    deleteAddress.init(ctx);
    // This page follows a record only when its network, "Use Blockscout" or
    // "Check recipients on Etherscan" differs from this page's. A record
    // written by this page's own save matches this page. A record naming no
    // network is no switch.
    onStorageChanged((changes) => {
        const written = changes.autistmask && changes.autistmask.newValue;
        if (!written || !written.networkId) return;
        if (
            written.networkId !== state.networkId ||
            written.useBlockscout !== state.useBlockscout ||
            written.checkRecipientsOnEtherscan !==
                state.checkRecipientsOnEtherscan
        ) {
            followStoredSettings();
        }
    });
    // A change saved since loadState() above, before there was a listener.
    followStoredSettings();
    if (!state.hasWallet) {
-        showView("welcome");
+        welcome.show();
    } else {
        renderWalletList();
        restoreView();
@@ -38,11 +38,16 @@ function markViewRendered(view) {
    if (view) renderedViews.add(view);
 }
-// Begin a fresh page-load scope. The popup gets one by being loaded, and
+// Begin a fresh page-load scope. The popup gets one by being loaded. It also
-// asks for one when the user switches the network, because every screen
+// asks for one when every screen on the page is out of date:
-// then on the page shows the previous network (views/settings.js); the
+//
-// unit tests, which simulate several page loads against one module
+//   - after a network switch, since those screens show the previous network
-// instance, ask for one too.
+//     (showNewSettings() in views/settings.js)
 //   - after "Use Blockscout" or "Check recipients on Etherscan" changes, here
 //     or on another page, since those screens were drawn under the old setting
 //
 // The unit tests ask for one too. They simulate several page loads against one
 // module instance.
 function resetRenderedViews() {
    renderedViews.clear();
 }
@@ -4,6 +4,7 @@ const {
    showFlash,
    balanceLinesForAddress,
    txCounterpartyHtml,
    HISTORY_OFF_TEXT,
    addressTitle,
    escapeHtml,
    displaySymbol,
@@ -83,6 +84,8 @@ function show() {
                ctx.showAddressToken();
            });
        });
    // Only Blockscout reports the tokens the user has not tracked.
    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
    renderSendTokenSelect(addr);
    $("tx-list").innerHTML =
        '<div class="text-muted text-xs py-1">Loading...</div>';
@@ -155,6 +158,10 @@ async function loadTransactions(address) {
 function renderTransactions(txs) {
    const list = $("tx-list");
    if (!state.useBlockscout) {
        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
        return;
    }
    if (txs.length === 0) {
        list.innerHTML =
            '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -229,7 +236,7 @@ function init(_ctx) {
        }
        $("send-to").value = "";
        $("send-amount").value = "";
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
        $("send-token-static").classList.add("hidden");
        updateSendBalance();
        resetSendValidation();
@@ -7,6 +7,7 @@ const {
    showFlash,
    flashCopyFeedback,
    txCounterpartyHtml,
    HISTORY_OFF_TEXT,
    addressTitle,
    escapeHtml,
    displaySymbol,
@@ -239,6 +240,10 @@ async function loadTransactions(address, tokenId) {
 function renderTransactions(txs) {
    const list = $("address-token-tx-list");
    if (!state.useBlockscout) {
        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
        return;
    }
    if (txs.length === 0) {
        list.innerHTML =
            '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -324,7 +329,7 @@ function init(_ctx) {
            $("send-token").value = tokenId;
        }
        // Hide dropdown, show static token display
-        $("send-token").classList.add("hidden");
+        $("send-token-dropdown").classList.add("hidden");
        let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
        if (tokenId !== "ETH") {
            staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
@@ -11,6 +11,7 @@ const {
    onViewLeave,
    formatFee,
    tokenLabel,
    blockscoutOffTokenNoteHtml,
    tokenSourcesByChainId,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
@@ -401,6 +402,10 @@ function showTxApproval(details) {
            if (d.address) {
                if (d.isToken) {
                    detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
                    detailsHtml += blockscoutOffTokenNoteHtml(
                        d.address,
                        approvedTx.chainId,
                    );
                }
                detailsHtml += approvalAddressHtml(
                    d.address,
@@ -623,10 +628,7 @@ function permitWarningHtml(types, primaryType, domain, message) {
            return "";
    }
-    const sources = {
+    const sources = tokenSourcesByChainId();
        trackedTokens: state.trackedTokens,
        wallets: state.wallets,
    };
    const spender = addressOrNull(
        declaredField(types, primaryType, message, "spender")?.value,
    );
@@ -655,6 +657,7 @@ function permitWarningHtml(types, primaryType, domain, message) {
        html += `<div class="mb-2"><div>Token</div>`;
        if (token) {
            html += `<div>${escapeHtml(tokenLabel(token) || "Unknown token")}</div>`;
            html += blockscoutOffTokenNoteHtml(token);
            html += approvalAddressHtml(token);
        } else {
            html += `<div>Unknown</div>`;
@@ -334,6 +334,11 @@ function show(txInfo) {
    $("confirm-contract-warning").style.visibility = "hidden";
    $("confirm-burn-warning").style.visibility = "hidden";
    $("confirm-etherscan-warning").style.visibility = "hidden";
    // While "Check recipients on Etherscan" is off, there is no Etherscan
    // warning to reserve space for. A line in its place says the check is off.
    const etherscanOn = !!state.checkRecipientsOnEtherscan;
    $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
    $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
    // Show burn warning via reserved element (in addition to inline warning)
    if (isBurnAddress(txInfo.to)) {
@@ -119,6 +119,11 @@ function show(walletIdx, addrIdx) {
    $("delete-address-recovery").textContent = recoveryPathText(wallet);
    $("delete-address-balance").innerHTML = balanceWarningHtml(addr);
    // Only Blockscout reports the tokens the user has not tracked.
    $("delete-address-tokens-note").classList.toggle(
        "hidden",
        !!state.useBlockscout,
    );
    setFlash("");
    showView("delete-address-confirm");
@@ -16,6 +16,7 @@ const {
    broadcastActiveChanged,
 } = require("../../shared/walletDelete");
 const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
 const welcome = require("./welcome");
 let deleteWalletIndex = null;
 let lostPasswordIndex = null;
@@ -135,7 +136,7 @@ async function finishDelete(walletIdx) {
        // Save before broadcasting: the background reads the active
        // address back out of storage to build accountsChanged.
        if (activeAddressChanged) broadcastActiveChanged();
-        showView("welcome");
+        welcome.show();
        return;
    }
@@ -21,7 +21,10 @@ const {
    truncateAmountNeverZero,
    isBelowOneMillionth,
 } = require("../../shared/amountDisplay");
-const { resolveTokenSymbol } = require("../../shared/approvalAmount");
+const {
    resolveTokenDecimals,
    resolveTokenSymbol,
 } = require("../../shared/approvalAmount");
 const { getProvider } = require("../../shared/balances");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
@@ -306,10 +309,16 @@ function nativeCurrency() {
 // names a token on one network only, and every token balance held is the
 // active network's, so another network gets the tokens tracked on it
 // (state.networkTrackedTokens, see applyChainSwitchFields()) and no balances.
 //
 // The wallets' balances hold what Blockscout reported for each token. So the
 // wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
    const net = chainId ? networkByChainId(chainId) : currentNetwork();
    if (net && net.id === state.networkId) {
-        return { trackedTokens: state.trackedTokens, wallets: state.wallets };
+        return {
            trackedTokens: state.trackedTokens,
            wallets: state.useBlockscout ? state.wallets : [],
        };
    }
    return {
        trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
@@ -317,11 +326,39 @@ function tokenSourcesByChainId(chainId) {
    };
 }
-// The symbol shown for a token line on the network with `chainId`, or on the
+// The line shown under a token while "Use Blockscout" is off. The token gets
-// active network when none is given: from the bundled list, the tokens the
+// the line only when the bundled list and the tracked tokens lack its name or
-// user tracks, and the explorer's report, the sources the amount line's scale
+// decimals. Otherwise this returns "". The token is a contract address on the
-// comes from. Null when no source names one, so the token lines keep saying
+// network with `chainId`, or on the active network when none is given. "ETH"
-// `Unknown token` for a token nothing knows.
+// and null are no contract, and get "". A token that is not text also gets "":
 // WaitTx and ErrorTx pass a token restored from storage unchecked.
 function blockscoutOffTokenNoteHtml(token, chainId) {
    if (typeof token !== "string") return "";
    if (state.useBlockscout || !token || token === "ETH") return "";
    const sources = tokenSourcesByChainId(chainId);
    if (
        resolveTokenSymbol(token, sources) !== null &&
        resolveTokenDecimals(token, sources) !== null
    ) {
        return "";
    }
    return (
        '<div class="text-xs text-muted">Blockscout\'s report of your balances' +
        ' is not used to name this token, because "Use Blockscout" is off in' +
        " Settings.</div>"
    );
 }
 // The symbol shown for a token line, from these sources in order:
 //
 // - the bundled list
 // - the tokens the user tracks
 // - the explorer's report, while "Use Blockscout" is on
 //
 // The network is the one with `chainId`, or the active network when none is
 // given. The amount line's scale comes from the same sources. Null when no
 // source names one, so the token lines keep saying `Unknown token` for a token
 // nothing knows.
 function tokenLabel(address, chainId) {
    return resolveTokenSymbol(address, tokenSourcesByChainId(chainId));
 }
@@ -534,6 +571,12 @@ function addressTitle(address, wallets) {
 const CONTRACT_CREATION_TEXT =
    "This transaction creates a new contract. It has no recipient.";
 // The line shown in place of the transaction history on Home, AddressDetail and
 // AddressToken while "Use Blockscout" is off. That history comes from
 // Blockscout alone.
 const HISTORY_OFF_TEXT =
    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
 // The last two lines of a transaction history row: the counterparty's colour
 // dot and name beside the amount, then its full address. A contract creation
 // the user sent has no counterparty (its `to` is ""), so its row has the
@@ -791,6 +834,7 @@ module.exports = {
    unknownableAmount,
    nativeCurrency,
    tokenSourcesByChainId,
    blockscoutOffTokenNoteHtml,
    tokenLabel,
    formatFee,
    addressDotHtml,
@@ -799,6 +843,7 @@ module.exports = {
    displaySymbol,
    addressTitle,
    CONTRACT_CREATION_TEXT,
    HISTORY_OFF_TEXT,
    txCounterpartyHtml,
    formatAddressHtml,
    renderAddressHtml,
@@ -7,6 +7,7 @@ const {
    timeAgo,
    addressDotHtml,
    txCounterpartyHtml,
    HISTORY_OFF_TEXT,
    addressTitle,
    escapeHtml,
    displaySymbol,
@@ -100,6 +101,10 @@ let homeTxs = [];
 function renderHomeTxList(ctx) {
    const list = $("home-tx-list");
    if (!list) return;
    if (!state.useBlockscout) {
        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
        return;
    }
    if (homeTxs.length === 0) {
        list.innerHTML =
            '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -300,6 +305,8 @@ function walletListHtml() {
 function render(ctx) {
    const container = $("wallet-list");
    // Only Blockscout reports the tokens the user has not tracked.
    $("home-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
    if (state.wallets.length === 0) {
        container.innerHTML =
            '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
@@ -447,7 +454,7 @@ function init(ctx) {
        }
        $("send-to").value = "";
        $("send-amount").value = "";
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
        $("send-token-static").classList.add("hidden");
        renderSendTokenSelect(addr);
        updateSendBalance();
@@ -10,6 +10,7 @@ const {
    renderAddressHtml,
    attachCopyHandlers,
    goBack,
    tokenSourcesByChainId,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
@@ -141,6 +142,8 @@ function updateToValidation() {
 }
 function renderSendTokenSelect(addr) {
    // Only Blockscout reports the tokens the user has not tracked.
    $("send-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
    const sel = $("send-token");
    sel.innerHTML = `<option value="ETH">${escapeHtml(nativeCurrency())}</option>`;
    const fraudSet = new Set(
@@ -185,7 +188,9 @@ function renderSendTokenSelect(addr) {
 // so the transfer is encoded with the number the user read rather than with
 // whatever the contract answers at signing time (see
 // src/shared/transferAmount.js). balances.js is formatting one explorer row at
-// fetch time and cannot consult a state it is in the middle of replacing.
+// fetch time and cannot consult a state it is in the middle of replacing. As on
 // the approval screens, tokenSourcesByChainId() gives the wallets only while
 // "Use Blockscout" is on.
 //
 // The two resolutions can therefore differ, and where they do, the stored
 // `balance` is a quantity computed at a scale this screen has just declined to
@@ -198,10 +203,7 @@ function tokenBalanceAndDecimals(addr, token) {
    const tb = (addr.tokenBalances || []).find(
        (t) => t.address.toLowerCase() === token.toLowerCase(),
    );
-    const tokenDecimals = resolveTokenDecimals(token, {
+    const tokenDecimals = resolveTokenDecimals(token, tokenSourcesByChainId());
        trackedTokens: state.trackedTokens,
        wallets: state.wallets,
    });
    if (!tb) return { tokenBalance: "0", tokenDecimals };
    if (tokenDecimals === null) return { tokenBalance: null, tokenDecimals };
    return { tokenBalance: tb.balance ?? null, tokenDecimals };
@@ -401,8 +403,11 @@ function init(_ctx) {
            try {
                const provider = getProvider(state.rpcUrl, state.networkId);
                const resolved = await provider.resolveName(to);
                // getProvider() does not look up a name resolved off-chain,
                // so such a name comes back with no address too. The message
                // covers both, in the one line the flash area shows.
                if (!resolved) {
-                    showFlash("That ENS name has no address.");
+                    showFlash("That ENS name has no on-chain address.");
                    return;
                }
                resolvedTo = resolved;
@@ -426,7 +431,7 @@ function init(_ctx) {
    });
    $("btn-send-back").addEventListener("click", () => {
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
        $("send-token-static").classList.add("hidden");
        goBack();
    });
@@ -17,6 +17,7 @@ const {
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { restorableStack } = require("../../shared/persistedState");
 const { dropUntrackedTokens } = require("../../shared/balances");
 const { resetRenderedViews, markViewRendered } = require("../viewRouter");
 const {
    log,
@@ -38,6 +39,8 @@ const {
 const { notify, sendMessage } = require("../../shared/browserApi");
 let ctx;
 let versionClickCount = 0;
 let versionClickTimer = null;
@@ -199,6 +202,10 @@ function show() {
    $("settings-rpc").value = state.rpcUrl;
    $("settings-blockscout").value = state.blockscoutUrl;
    $("settings-network").value = state.networkId;
    // Set on every show, not only at init: Welcome can change these two.
    $("settings-use-blockscout").checked = state.useBlockscout;
    $("settings-check-recipients-on-etherscan").checked =
        state.checkRecipientsOnEtherscan;
    renderTrackedTokens();
    renderSiteLists();
    renderWalletListSettings();
@@ -243,7 +250,77 @@ async function renderSiteLists() {
    );
 }
-function init(ctx) {
+// A network switch, made by the user here or saved by the background once the
 // user approved a site's request (src/popup/index.js), leaves every screen on
 // the page showing the previous network. Two functions leave the page as
 // README's Screen Map describes:
 //
 // - cutViewStack(), before the switch is saved, so that save keeps the cut for
 //   a popup closed straight after
 // - showNewSettings(), once `state` holds the new network
 //
 // The stack is cut at the first screen that cannot be rendered from saved
 // state, such as Send or AddToken, and at AddressToken unless it shows the
 // native token: any other token there was picked on the previous network, so
 // it is no longer selected either. Without a wallet the stack starts at
 // Welcome, which that cut would drop, and Welcome shows nothing from a network.
 // A change to "Use Blockscout" cuts the stack the same way (setUseBlockscout()
 // below).
 function cutViewStack() {
    if (!state.hasWallet) return;
    if (state.selectedToken !== "ETH") {
        const tokenView = state.viewStack.indexOf("address-token");
        if (tokenView !== -1) {
            state.viewStack = state.viewStack.slice(0, tokenView);
        }
        state.selectedToken = null;
    }
    state.viewStack = restorableStack(state.viewStack, state.currentView);
 }
 // Sets "Use Blockscout" to `on` on this page. It is called inside a save,
 // holding the lock, for the user's change here or another page's
 // (followStoredSettings() in src/popup/index.js).
 //
 // Send's token dropdown was filled under the old setting, and Back cannot draw
 // Send again. So the stack is cut, as for a network switch. Turning the setting
 // off also drops every token the user has not tracked.
 function setUseBlockscout(on) {
    state.useBlockscout = on;
    cutViewStack();
    if (!on) dropUntrackedTokens(state.wallets, state.trackedTokens);
 }
 // Draws the page again after a network switch, or after another page changed
 // "Use Blockscout" or "Check recipients on Etherscan". Every screen counts as
 // not yet rendered, so "Back" renders again any screen that a reopened popup
 // can render. Settings on top is brought up to date in place. Any other screen
 // is drawn again as a reopened popup draws it, which is Home for one that
 // cannot be rendered from saved state. Without a wallet any other screen is
 // Welcome or AddWallet. Back only unhides Welcome, so its two checkboxes are
 // set here.
 function showNewSettings() {
    resetRenderedViews();
    $("welcome-use-blockscout").checked = state.useBlockscout;
    $("welcome-check-recipients-on-etherscan").checked =
        state.checkRecipientsOnEtherscan;
    if (state.currentView === "settings") {
        markViewRendered("settings");
        $("settings-network").value = state.networkId;
        $("settings-rpc").value = state.rpcUrl;
        $("settings-blockscout").value = state.blockscoutUrl;
        $("settings-use-blockscout").checked = state.useBlockscout;
        $("settings-check-recipients-on-etherscan").checked =
            state.checkRecipientsOnEtherscan;
        renderTrackedTokens();
    } else if (state.hasWallet) {
        ctx.restoreView();
    }
    updateDebugBanner(state.currentView);
 }
 function init(_ctx) {
    ctx = _ctx;
    deleteWallet.init(ctx);
    showPhrase.init();
@@ -317,39 +394,49 @@ function init(ctx) {
        showFlash("Saved.");
    });
    // Each change is made inside the save, holding the lock. So
    // followStoredSettings() in src/popup/index.js never mistakes this page's
    // unsaved change for one that another page saved.
    //
    // The screens under Settings were drawn under the old setting. So each
    // change makes every screen but Settings count as not yet drawn, as a
    // network switch does. Back then draws again any screen that a reopened
    // popup can draw. Back only unhides Welcome, so its boxes are set here too.
    $("settings-use-blockscout").addEventListener("change", async () => {
        const on = $("settings-use-blockscout").checked;
        await saveState(() => setUseBlockscout(on));
        $("welcome-use-blockscout").checked = on;
        resetRenderedViews();
        markViewRendered("settings");
    });
    $("settings-check-recipients-on-etherscan").addEventListener(
        "change",
        async () => {
            const on = $("settings-check-recipients-on-etherscan").checked;
            await saveState(() => {
                state.checkRecipientsOnEtherscan = on;
            });
            $("welcome-check-recipients-on-etherscan").checked = on;
            resetRenderedViews();
            markViewRendered("settings");
        },
    );
    const networkSelect = $("settings-network");
    networkSelect.addEventListener("change", async () => {
        // Whether `state` already has the network picked is asked only once
        // the switch holds the lock: while an earlier pick waits for it,
        // `state` still has the network before that pick, and a pick back to
        // that network must still be made.
        const newId = networkSelect.value;
-        if (newId === state.networkId) return;
+        cutViewStack();
        // The screens beneath Settings show the previous network, so Back
        // finds them as it does in a reopened popup: each is rendered again
        // when Back lands on it, and the stack is cut at the first one that
        // cannot be rendered from saved state, such as Send or AddToken. It
        // is cut at AddressToken too, unless that shows the native token: any
        // other token there was picked on the previous network. Without a
        // wallet the stack starts at Welcome, which that cut would drop, and
        // Welcome shows nothing from a network. The cut comes before the
        // switch so that the switch's save keeps it for a popup closed
        // straight after.
        if (state.hasWallet) {
            const tokenView = state.viewStack.indexOf("address-token");
            if (tokenView !== -1 && state.selectedToken !== "ETH") {
                state.viewStack = state.viewStack.slice(0, tokenView);
            }
            state.viewStack = restorableStack(state.viewStack, "settings");
        }
        const net = await onChainSwitch(newId);
        if (!net) return;
        // Open pages are told by the background, as after a site's approved
        // switch request.
        notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        resetRenderedViews();
+        showNewSettings();
        // Settings itself, and the testnet banner above it, are brought up
        // to date for the new network here.
        markViewRendered("settings");
        $("settings-rpc").value = state.rpcUrl;
        $("settings-blockscout").value = state.blockscoutUrl;
        renderTrackedTokens();
        updateDebugBanner(state.currentView);
        showFlash("Switched to " + net.name + ".");
    });
@@ -484,4 +571,11 @@ function init(ctx) {
    });
 }
-module.exports = { init, show, renderSiteLists };
+module.exports = {
    init,
    show,
    renderSiteLists,
    cutViewStack,
    setUseBlockscout,
    showNewSettings,
 };
@@ -24,7 +24,11 @@
 // than written again locally so that tests/popupElementIds.test.js sees these
 // lookups and holds every id below against the markup.
 const { $, VIEWS } = require("./helpers");
-const { storageGet, storageRemove } = require("../../shared/browserApi");
+const {
    storageGet,
    storageRemove,
    withLock,
 } = require("../../shared/browserApi");
 const { log } = require("../../shared/log");
 // Typed in full before anything is erased, in the same spirit as the wallet
@@ -137,7 +141,11 @@ async function resetProfile() {
        return;
    }
    try {
-        await storageRemove("autistmask");
+        // Under the lock every write of the stored record takes, so the erase
        // cannot land between another write's read and its write and be undone.
        // A page in a Firefox private window is the exception: Firefox gives
        // it locks of its own (README, "Stored state and its version").
        await withLock("autistmask", () => storageRemove("autistmask"));
    } catch (e) {
        log.errorf("state recovery: reset failed:", e);
        setFlash("The saved data could not be erased. Nothing was changed.");
@@ -26,6 +26,7 @@ const { state } = require("../../shared/state");
 const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("../../shared/log");
 const { storedSettingIsOn } = require("../../shared/storedSettings");
 const { decodeCalldata } = require("./approval");
 /**
@@ -172,7 +173,8 @@ function render() {
        }
    }
-    // Hide calldata and raw data sections; always fetch full tx details
+    // Hide the calldata and raw data sections. loadFullTxDetails() shows them
    // once it has their data.
    const calldataSection = $("tx-detail-calldata-section");
    if (calldataSection) calldataSection.classList.add("hidden");
    const rawDataSection = $("tx-detail-rawdata-section");
@@ -191,6 +193,12 @@ function render() {
        if (el) el.classList.add("hidden");
    }
    // The block, network details, decoded details and raw data come from
    // Blockscout. While the setting is off, this line says why none is shown.
    $("tx-detail-blockscout-note").classList.toggle(
        "hidden",
        !!state.useBlockscout,
    );
    loadFullTxDetails(tx.hash, tx.chainId);
    const isoStr = isoDate(tx.timestamp);
@@ -303,7 +311,12 @@ function populateOnChainDetails(txData, chainId) {
    }
 }
 // Reads the block, network details and calldata from Blockscout, and decodes
 // the calldata. While the stored "Use Blockscout" is off, Blockscout is not
 // asked. An answer that lands after the setting went off is dropped
 // (src/shared/storedSettings.js). Either way none of them is shown.
 async function loadFullTxDetails(txHash, chainId) {
    if (!(await storedSettingIsOn("useBlockscout"))) return;
    const section = $("tx-detail-calldata-section");
    const actionEl = $("tx-detail-calldata-action");
    const detailsEl = $("tx-detail-calldata-details");
@@ -319,6 +332,7 @@ async function loadFullTxDetails(txHash, chainId) {
        );
        if (!resp.ok) return;
        const txData = await resp.json();
        if (!(await storedSettingIsOn("useBlockscout"))) return;
        // Populate on-chain detail fields (block, nonce, gas, fee)
        populateOnChainDetails(txData, chainId);
@@ -14,6 +14,7 @@ const {
    displaySymbol,
    clearViewStack,
    tokenLabel,
    blockscoutOffTokenNoteHtml,
    reviewedNetworkProvider,
 } = require("./helpers");
 const { state } = require("../../shared/state");
@@ -108,6 +109,10 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
    }
    $("wait-tx-summary").textContent =
        txInfo.amount + (symbol ? " " + symbol : "");
    $("wait-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
        txInfo.token,
        txInfo.chainId,
    );
    $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to, txInfo.chainId);
    $("wait-tx-hash").innerHTML = txHashHtml(txHash, txInfo.chainId);
    attachCopyHandlers("view-wait-tx");
@@ -215,9 +220,10 @@ function showWait(txInfo, txHash) {
 // init and leaving wait-tx on screen with no back control. A non-numeric
 // broadcastTime leaves an unexitable wait counting "NaNs". txInfo.chainId picks
 // the node the receipt is asked of and the explorer the links open, so it has
-// to name a network. txInfo.token and txInfo.tokenSymbol are deliberately
+// to name a network. txInfo.token and txInfo.tokenSymbol are not checked here.
-// unchecked: they are compared and coalesced rather than dereferenced, and
+// blockscoutOffTokenNoteHtml() shows no line for a token that is not text.
-// tokenSymbol is null for ETH.
+// Everything else only compares and coalesces them, and tokenSymbol is null for
 // ETH.
 function restoreWait() {
    const d = state.viewData;
    if (!d || !d.pendingWait) return false;
@@ -282,6 +288,7 @@ function decodedDetailsHtml(decoded, chainId) {
            if (d.isToken) {
                const sym = tokenLabel(d.address, chainId) || "Unknown token";
                html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
                html += blockscoutOffTokenNoteHtml(d.address, chainId);
                html += toAddressHtml(d.address, chainId);
            } else {
                html += toAddressHtml(d.address, chainId);
@@ -345,6 +352,7 @@ function showError(txInfo, txHash, message) {
    state.viewData = {
        amount: txInfo.amount,
        symbol: symbol,
        token: txInfo.token,
        to: txInfo.to,
        hash: txHash || null,
        message: message,
@@ -358,6 +366,10 @@ function renderError() {
    if (!d || !d.message) return;
    $("error-tx-summary").textContent =
        d.amount + (d.symbol ? " " + d.symbol : "");
    $("error-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
        d.token,
        d.chainId,
    );
    $("error-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
    $("error-tx-message").textContent = d.message;
@@ -1,7 +1,37 @@
-const { $ } = require("./helpers");
+// The first screen, shown while there is no wallet. It offers "Use Blockscout"
 // and "Check recipients on Etherscan", which Settings offers too. Both are off
 // until the user ticks them.
-function init(ctx) {
+const { $, showView } = require("./helpers");
-    $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
+const { state, saveState } = require("../../shared/state");
 function show() {
    $("welcome-use-blockscout").checked = state.useBlockscout;
    $("welcome-check-recipients-on-etherscan").checked =
        state.checkRecipientsOnEtherscan;
    showView("welcome");
 }
-module.exports = { init };
+// Each change is made inside the save, holding the lock, as Settings makes it.
 function init(ctx) {
    $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
    $("welcome-use-blockscout").addEventListener("change", async () => {
        const on = $("welcome-use-blockscout").checked;
        await saveState(() => {
            state.useBlockscout = on;
        });
    });
    $("welcome-check-recipients-on-etherscan").addEventListener(
        "change",
        async () => {
            const on = $("welcome-check-recipients-on-etherscan").checked;
            await saveState(() => {
                state.checkRecipientsOnEtherscan = on;
            });
        },
    );
 }
 module.exports = { init, show };
@@ -1,5 +1,10 @@
-// Balance fetching: ETH balances via RPC, ERC-20 token balances via
+// Balance fetching:
-// Blockscout, ENS reverse lookup via RPC.
+//
 //   - ETH balances, and the balances of the tokens the user tracks, via RPC
 //   - the other ERC-20 token balances and the holder counts via Blockscout,
 //     while the user has "Use Blockscout" on. Those balances are dropped when
 //     the setting is off.
 //   - ENS reverse lookup via RPC
 const {
    JsonRpcProvider,
@@ -17,6 +22,7 @@ const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
 const { resolveTokenDecimals } = require("./approvalAmount");
 const { storedSettingIsOn } = require("./storedSettings");
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -36,9 +42,18 @@ const { resolveTokenDecimals } = require("./approvalAmount");
 // ethers knows chains this wallet does not, so an id that is not one of ours
 // is a caller bug and must not resolve to a working provider for some other
 // chain.
 //
 // `disableCcipRead` keeps every ENS lookup on the RPC endpoint. A resolver can
 // say a name is resolved off-chain and give a web address for it. By default
 // ethers then fetches that address straight from the browser, sending the name
 // being looked up. For the reverse lookup of the user's addresses, the name sent
 // is the user's own (https://git.eeqj.de/sneak/AutistMask/issues/668). With the
 // flag set, such a name does not resolve.
 function getProvider(rpcUrl, networkId) {
    const net = Network.from(requireNetworkId(networkId).id);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
    provider.disableCcipRead = true;
    return provider;
 }
 function requireNetworkId(networkId) {
@@ -80,8 +95,16 @@ function rawUnits(value) {
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
 //
 // While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
 // that lands after the setting went off is dropped
 // (src/shared/storedSettings.js). Either way this returns an empty list, so
 // only tracked tokens are listed.
 //
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders.
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
 // balance is read through the RPC endpoint instead, and its row here gives that
 // entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -96,6 +119,7 @@ async function fetchTokenBalances(
    trackedTokens,
    signal,
 ) {
    if (!(await storedSettingIsOn("useBlockscout"))) return [];
    try {
        const resp = await debugFetch(
            blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -105,6 +129,7 @@ async function fetchTokenBalances(
            return null;
        }
        const items = await resp.json();
        if (!(await storedSettingIsOn("useBlockscout"))) return [];
        if (!Array.isArray(items)) return null;
        const trackedSet = new Set(
@@ -205,8 +230,96 @@ async function fetchTokenBalances(
    }
 }
-// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// The entries at `address` of the tokens the user tracks, shaped as
 // fetchTokenBalances() returns them, for the tokens the address holds.
 //
 // The balance is read with balanceOf through the RPC endpoint. The name and
 // symbol are the tracked token's. `decimals` and `holders` are those of
 // Blockscout's entry for the token in `explorerRequest`, this refresh's
 // fetchTokenBalances() for the address; while Blockscout fails they are kept
 // from the token's entry in `previous`, the address's entries before this
 // refresh. The balance is stated at the scale the screens read the token at
 // (resolveTokenDecimals()): the bundled list's, then the one the tracked token
 // records, then Blockscout's, as in fetchTokenBalances().
 //
 // A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
 // balance keeps its figure, or takes Blockscout's entry from this refresh when
 // it has none. The failure is logged. A balance of zero gets no entry, as a
 // zero Blockscout reports gets none: the balance lists take a tracked token's
 // zero from the tracked list. A token whose symbol the spoof rule refuses gets
 // no entry either, as in fetchTokenBalances().
 //
 // `signal` is as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
    provider,
    address,
    trackedTokens,
    previous,
    explorerRequest,
    signal,
 ) {
    const listed = trackedTokens.filter(
        (token) => !isSpoofedSymbol(token.symbol, token.address),
    );
    // Each token's balanceOf answer, or null where it failed.
    const balances = await Promise.all(
        listed.map(async (token) => {
            try {
                const contract = new Contract(
                    token.address,
                    ERC20_ABI,
                    provider,
                );
                return await contract.balanceOf(address);
            } catch (e) {
                if (!signal?.aborted) {
                    log.errorf(
                        "token balance failed",
                        address,
                        token.address,
                        e.shortMessage || e.message,
                    );
                }
                return null;
            }
        }),
    );
    const explorerRows = await explorerRequest;
    const reported = explorerRows ?? previous;
    const rows = [];
    listed.forEach((token, i) => {
        const lower = token.address.toLowerCase();
        const entryIn = (list) =>
            list.find((row) => String(row.address).toLowerCase() === lower);
        const raw = balances[i];
        if (raw === null) {
            const kept = entryIn(previous) || entryIn(explorerRows || []);
            if (kept) rows.push(kept);
            return;
        }
        if (raw === 0n) return;
        const entry = entryIn(reported);
        const decimals = entry ? entry.decimals : null;
        const known = resolveTokenDecimals(lower, { trackedTokens });
        const scale = known !== null ? known : decimals;
        rows.push({
            address: token.address,
            name: token.name || "",
            symbol: token.symbol || "???",
            decimals: decimals,
            // null when nothing knows the scale: a holding whose amount
            // cannot be stated, never a zero.
            balance: scale === null ? null : formatTokenBalance(raw, scale),
            holders: entry ? entry.holders : null,
        });
    });
    return rows;
 }
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
 // `trackedTokens` are the tokens tracked on the active network. `signal` is as
 // for fetchTokenBalances().
 async function refreshBalances(
    wallets,
    rpcUrl,
@@ -217,6 +330,8 @@ async function refreshBalances(
 ) {
    log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
    const provider = getProvider(rpcUrl, networkId);
    const tracked = trackedTokens || [];
    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
    const updates = [];
    for (const wallet of wallets) {
@@ -266,23 +381,43 @@ async function refreshBalances(
                    }),
            );
-            // ERC-20 token balances via Blockscout
+            // ERC-20 token balances: the tracked tokens' through the RPC
            // endpoint, and from Blockscout the tokens the user has not
            // tracked. When Blockscout fails, the untracked rows from before
            // this refresh stay. While "Use Blockscout" is off, there are no
            // untracked rows. The Blockscout request is started first and
            // handed to fetchTrackedTokenBalances() too, which waits for it
            // after sending its balanceOf reads, so the two run side by side.
            const previous = addr.tokenBalances || [];
            const explorerRequest = fetchTokenBalances(
                addr.address,
                blockscoutUrl,
                tracked,
                signal,
            );
            updates.push(
-                fetchTokenBalances(
+                Promise.all([
-                    addr.address,
+                    fetchTrackedTokenBalances(
-                    blockscoutUrl,
+                        provider,
-                    trackedTokens,
+                        addr.address,
-                    signal,
+                        tracked,
-                ).then((balances) => {
+                        previous,
-                    if (balances !== null) {
+                        explorerRequest,
-                        addr.tokenBalances = balances;
+                        signal,
-                        log.debugf(
+                    ),
-                            "Token balances",
+                    explorerRequest,
-                            addr.address,
+                ]).then(([trackedRows, explorerRows]) => {
-                            balances.length,
+                    const untrackedRows = (explorerRows ?? previous).filter(
-                            "tokens",
+                        (row) =>
-                        );
+                            !trackedSet.has(String(row.address).toLowerCase()),
-                    }
+                    );
                    addr.tokenBalances = trackedRows.concat(untrackedRows);
                    log.debugf(
                        "Token balances",
                        addr.address,
                        addr.tokenBalances.length,
                        "tokens",
                    );
                }),
            );
        }
@@ -292,6 +427,20 @@ async function refreshBalances(
    log.debugf("refreshBalances done");
 }
 // Drops the balance of each token not in `trackedTokens` from every address.
 // Callers run it while "Use Blockscout" is off, since only Blockscout reports
 // those tokens.
 function dropUntrackedTokens(wallets, trackedTokens) {
    const tracked = new Set(trackedTokens.map((t) => t.address.toLowerCase()));
    for (const wallet of wallets) {
        for (const addr of wallet.addresses || []) {
            addr.tokenBalances = (addr.tokenBalances || []).filter((row) =>
                tracked.has(String(row.address).toLowerCase()),
            );
        }
    }
 }
 // Look up token metadata from its contract.
 // Calls symbol() and decimals() to verify it implements ERC-20.
 // `signal` is as for fetchTokenBalances().
@@ -410,6 +559,7 @@ async function scanForAddresses(xpub, rpcUrl, networkId, signal, gapLimit = 5) {
 module.exports = {
    fetchTokenBalances,
    refreshBalances,
    dropUntrackedTokens,
    lookupTokenInfo,
    getProvider,
    scanForAddresses,
@@ -31,6 +31,11 @@
 // Everything is resolved on use rather than captured at module load. The MV3
 // service worker is torn down and re-evaluated repeatedly, and the unit
 // suite installs its stubs on `global.chrome` around a require().
 //
 // The module also holds withLock(), a wrapper around the browser's
 // `navigator.locks`, which is in neither namespace. It sits beside
 // storageGet() and storageSet() because every write of the stored record
 // takes it.
 // The extension API namespace, preferring `browser.*` where it exists.
 //
@@ -219,6 +224,46 @@ function storageRemove(keys) {
    return Promise.resolve(storage.remove(keys));
 }
 /**
 * Call `listener` after every write to `storage.local`, whether this page,
 * another page or the background made it, with what the write changed, as the
 * browser reports it: `{ [key]: { oldValue, newValue } }`.
 *
 * @param {function(Object): void} listener
 */
 function onStorageChanged(listener) {
    namespaceMember("storage").onChanged.addListener((changes, areaName) => {
        if (areaName === "local") listener(changes);
    });
 }
 /**
 * Run `fn` while holding the browser's lock called `name`
 * (`navigator.locks`), and settle as `fn` settles. Every page of the extension
 * and its background share these locks, except a page in a Firefox private
 * window (README, "Stored state and its version"), so while one of them holds
 * `name` another asking for it waits, in the order they asked. The lock is let
 * go when `fn` settles, whether it resolved or rejected.
 *
 * Every write of the stored record holds the lock named after its key,
 * "autistmask", from its read to its write: saveState() in
 * src/shared/state.js, updateState() in src/background/state.js, and the
 * reset in src/popup/views/stateRecovery.js.
 *
 * @param {string} name
 * @param {function(): Promise<*>} fn
 * @returns {Promise<*>} what `fn` resolved with.
 * @throws rejects, without running `fn`, where `navigator.locks` is absent.
 */
 function withLock(name, fn) {
    if (typeof navigator === "undefined" || !navigator.locks) {
        return Promise.reject(
            new Error("navigator.locks is not available in this context"),
        );
    }
    return navigator.locks.request(name, () => fn());
 }
 // `storage.session`, the browser's session storage: what is kept there lasts
 // until the browser closes. It survives the background worker being stopped
 // and started again, which module-level variables do not (README, Background
@@ -353,6 +398,7 @@ module.exports = {
    getPlatformInfo,
    hasBrowserNamespace,
    notify,
    onStorageChanged,
    runtimeApi,
    sendMessage,
    sessionStorageGet,
@@ -373,4 +419,5 @@ module.exports = {
    windowsGetLastFocused,
    windowsRemove,
    windowsUpdate,
    withLock,
 };
@@ -1,8 +1,18 @@
-// Consolidated chain-switch handler for the popup.
+// The popup's network switch.
 //
-// Every state change required when the active network changes is
+// A network switch reaches the popup's `state` in one of two ways:
-// performed here so that callers (settings UI, future chain additions) all go
+//
-// through a single code path.
+// - onChainSwitch() below makes the switch the user picks in Settings, with
 //   applyChainSwitchFields() (chainSwitchFields.js).
 // - followStoredSettings() in src/popup/index.js takes a switch the background
 //   or another popup page saved, from the stored record, with
 //   takeStoredNetwork() (state.js), which copies it with
 //   copyChainSwitchFields() (chainSwitchFields.js).
 //
 // Both change `state` inside a save, holding the lock, and both reset the
 // popup's own caches through clearPopupCaches(), so a reset added there
 // reaches both. A field applyChainSwitchFields() sets has to be copied by
 // copyChainSwitchFields() too.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
@@ -20,22 +30,32 @@
 const { applyChainSwitchFields } = require("./chainSwitchFields");
 const { clearPrices } = require("./prices");
 // The popup's own caches a network switch resets. Prices are chain-specific
 // (testnet tokens are worthless, ETC has different pricing, etc.). In-memory
 // and per bundle, so this is the popup's own cache — the only context that
 // ever fills it.
 function clearPopupCaches() {
    clearPrices();
 }
 // Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain.
+// Returns the network configuration object for the new chain, or null when
 // `state` already has that network once the save holds the lock, and nothing
 // is switched.
 //
 // `state` is switched inside the save that stores the switch, holding the
 // lock, so it is never switched while a follow of a switch saved elsewhere
 // waits for the lock (followStoredSettings() in src/popup/index.js): that
 // follow runs first, and this switch is made after it.
 async function onChainSwitch(newNetworkId) {
    const { state, saveState } = require("./state");
-
+    let net = null;
-    const net = applyChainSwitchFields(state, newNetworkId);
+    await saveState(() => {
-
+        if (state.networkId === newNetworkId) return false;
-    // --- price cache ---
+        net = applyChainSwitchFields(state, newNetworkId);
-    // Prices are chain-specific (testnet tokens are worthless,
+        clearPopupCaches();
-    // ETC has different pricing, etc.). In-memory and per bundle, so this is
+    });
    // the popup's own cache — the only context that ever fills it.
    clearPrices();
    await saveState();
    return net;
 }
-module.exports = { onChainSwitch };
+module.exports = { onChainSwitch, clearPopupCaches };
@@ -7,7 +7,7 @@
 // the singleton and saves; the background applies it to the detached record of
 // its own read-modify-write (src/background/state.js).
 //
-// Everything here is synchronous and touches nothing but the object it is
+// Everything here is synchronous and touches nothing but the objects it is
 // given: no storage, no caches, no imports beyond the network table. That is
 // what makes it usable on a record that has been read fresh from storage
 // microseconds earlier and is about to be written back.
@@ -76,4 +76,33 @@ function applyChainSwitchFields(s, newNetworkId) {
    return net;
 }
-module.exports = { applyChainSwitchFields };
+// Give `s` every field applyChainSwitchFields() sets, as `switched` holds it:
 // the popup takes a switch the background saved from the stored record this
 // way, rather than performing it again (takeStoredNetwork() in
 // src/shared/state.js). Balances are taken by address, and an address
 // `switched` does not have keeps none.
 function copyChainSwitchFields(s, switched) {
    s.networkEndpoints = switched.networkEndpoints;
    s.networkTrackedTokens = switched.networkTrackedTokens;
    s.trackedTokens = switched.trackedTokens;
    s.networkId = switched.networkId;
    s.rpcUrl = switched.rpcUrl;
    s.blockscoutUrl = switched.blockscoutUrl;
    s.lastBalanceRefresh = switched.lastBalanceRefresh;
    s.tokenHolderCache = switched.tokenHolderCache;
    s.fraudContracts = switched.fraudContracts;
    const stored = new Map();
    for (const wallet of switched.wallets) {
        for (const addr of wallet.addresses) stored.set(addr.address, addr);
    }
    for (const wallet of s.wallets) {
        for (const addr of wallet.addresses) {
            const got = stored.get(addr.address);
            addr.balance = got ? got.balance : "0";
            addr.tokenBalances = got ? got.tokenBalances : [];
        }
    }
 }
 module.exports = { applyChainSwitchFields, copyChainSwitchFields };
@@ -3,6 +3,7 @@
 // This is a best-effort enrichment: network failures return null silently.
 const { networkByChainId } = require("./networks");
 const { storedSettingIsOn } = require("./storedSettings");
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
@@ -78,12 +79,19 @@ function parseEtherscanPage(html) {
 * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
 * Sepolia.
 *
 * While the stored "Check recipients on Etherscan" is off, Etherscan is not
 * asked. An answer that lands after the setting went off is dropped
 * (src/shared/storedSettings.js). Either way the answer is null.
 *
 * @param {string} address - Ethereum address to check.
 * @param {string} [chainId] - Chain id of the network to look it up on.
 * @returns {Promise<{type: string, message: string, severity: string}|null>}
 */
 async function checkEtherscanLabel(address, chainId) {
    try {
        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
            return null;
        }
        // Lazy require to avoid pulling in chrome.storage at module scope
        // (which breaks unit tests that only exercise parseEtherscanPage).
        const { currentNetwork } = require("./state");
@@ -94,6 +102,9 @@ async function checkEtherscanLabel(address, chainId) {
        });
        if (!resp.ok) return null;
        const html = await resp.text();
        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
            return null;
        }
        const result = parseEtherscanPage(html);
        if (result.isPhishing) {
            return {
@@ -48,6 +48,14 @@ const DEFAULT_STATE = {
    hideDustTransactions: true,
    dustThresholdGwei: 100000,
    utcTimestamps: false,
    // "Use Blockscout" and "Check recipients on Etherscan" in Settings. Each
    // setting applies to every network. Both are off until the user turns them
    // on. With "Use Blockscout" on, Blockscout is sent the user's addresses and
    // the hash of each transaction opened. With "Check recipients on
    // Etherscan" on, Etherscan is sent the recipient's address and nothing
    // else.
    useBlockscout: false,
    checkRecipientsOnEtherscan: false,
    fraudContracts: [],
    tokenHolderCache: {},
    theme: "system",
@@ -406,6 +414,10 @@ function normalizePersisted(saved) {
            : 100000;
    out.utcTimestamps =
        saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
    // Anything but true is off: each setting lets a request reach another
    // service.
    out.useBlockscout = saved.useBlockscout === true;
    out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true;
    // A list of contract addresses, floored the same way: send.js builds its
    // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
    // and filterTransactions() maps the same list through normalizeAddress(),
@@ -23,6 +23,7 @@
 // guarantee.
 const { networkById } = require("./networks");
 const { copyChainSwitchFields } = require("./chainSwitchFields");
 const {
    DEFAULT_STATE,
    PERSISTED_FIELDS,
@@ -35,7 +36,7 @@ const {
    migrationNeeded,
 } = require("./stateSchema");
-const { storageGet, storageSet } = require("./browserApi");
+const { storageGet, storageSet, withLock } = require("./browserApi");
 const { log } = require("./log");
 // The live record the proxy below guards. Everything inside this module reads
@@ -125,8 +126,10 @@ function currentNetwork() {
 }
 // The persisted fields as this page held them when its last loadState()
-// finished, or when its last successful saveState() began. saveState() diffs
+// finished, or when its last successful saveState() began, with any network
-// the live state against this to find only the fields THIS page changed since.
+// switch saved elsewhere that this page has taken since (takeStoredNetwork()).
 // saveState() diffs the live state against this to find only the fields THIS
 // page changed since.
 //
 // Deep-cloned, not a reference: callers mutate persisted objects and arrays
 // in place (state.wallets.push(...)), and a reference baseline would mutate
@@ -458,20 +461,20 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // This page's own live `state` is deliberately NOT rehydrated from a field
 // another page changed — only the record written to storage is merged.
 // showView() fires saveState() on every navigation without awaiting it,
-// which is what makes the queue above necessary in the first place, and a
+// which is why saves from one page wait for each other (see saveState()), and
-// save that is slow to come back has no way to tell whether the field it
+// a save that is slow to come back has no way to tell whether the field it
 // is about to hand back is still the current answer or has since been
 // overtaken by something this very page did in the meantime; writing it
 // into `state` regardless reintroduced exactly the clobber this function
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current.
+// before this fix; only the persisted record is guaranteed current. Three
-async function saveStateOnce() {
+// fields are the exceptions: the network, "Use Blockscout" and "Check
-    // A copy, so what this save compares and writes is the page's state as it
+// recipients on Etherscan". Through `beforeWrite`, the popup takes a change to
-    // stood when the save began. A change made while it waits on storage is
+// any of them that another context saved (followStoredSettings() in
-    // left for the next save, which compares against this copy.
+// src/popup/index.js).
-    const current = structuredClone(snapshotPersisted());
+async function saveStateOnce(beforeWrite) {
    const result = await storageGet("autistmask");
    // The record in storage right now is about to be merged into and written
    // back, so it is validated exactly like a load validates it. Without this,
@@ -485,6 +488,12 @@ async function saveStateOnce() {
    // come from storage in its loaded (self-healed) shape. See
    // normalizePersisted() in persistedState.js.
    const fresh = normalizePersisted(result.autistmask);
    if (beforeWrite && beforeWrite(fresh) === false) return;
    // A copy, so what this save compares and writes is the page's state as it
    // stood once the stored record was read. A change made while it waits on
    // the write is left for the next save, which compares against this copy.
    const current = structuredClone(snapshotPersisted());
    const merged = { ...fresh };
    for (const key of PERSISTED_FIELDS) {
@@ -529,35 +538,21 @@ async function saveStateOnce() {
    rawState.hasWallet = rawState.wallets.length > 0;
    // What this save compared and wrote, not the page's state now: a change
-    // made during the save must still differ from the baseline, or the save
+    // made during the save must still differ from the baseline, or the next
-    // queued after it finds nothing to store
+    // save finds nothing to store
    // (https://git.eeqj.de/sneak/AutistMask/issues/448).
    baseline = current;
 }
 // showView() calls saveState() on every navigation without awaiting it, so
 // two saves from the SAME page can be in flight at once — e.g. a screen
 // shown, then immediately replaced before the first save's storageGet()
 // round trip has come back. Left concurrent, the first save's turn would
 // finish after the second's live-state mutation and then re-hydrate `state`
 // from what IT read, stomping the second, later change back to a stale
 // value — the same clobber this function exists to prevent, just between
 // two saves on one page instead of two pages. Queuing makes every save's
 // snapshot-diff-write-rehydrate run start to finish before the next one
 // begins, so each one only ever sees the true live state at its turn.
 let saveQueue = Promise.resolve();
 // Where a failed save is REPORTED, set once by the context that has a screen
 // to say it on (src/popup/index.js).
 //
 // A save that fails must not fail silently. showView() fires saveState() on
-// every navigation without awaiting it, and the queue below has to attach a
+// every navigation without awaiting it, and `await saveState()` inside an
-// rejection handler to keep advancing — so a failing save was swallowed
+// unguarded event handler is no better: either way, without this, a failure
-// entirely: no throw, no message, nothing on screen. The wallet kept running
+// would reach only the console, where the user never looks, and the wallet
-// against storage that was rejecting every write, which is the data-loss half
+// would keep running against storage that rejects every write. That is the
-// of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
+// data-loss half of https://git.eeqj.de/sneak/AutistMask/issues/362.
 // no better off: `await saveState()` inside an unguarded event handler surfaces
 // in the console and nowhere the user looks.
 //
 // This is the "tell the user" half; the other half is the floor in
 // normalizePersisted(), which stops the malformed-record cause from arising in
@@ -583,11 +578,25 @@ function reportSaveFailure(err) {
    }
 }
-function saveState() {
+// Each save runs start to finish holding the lock every write of the stored
-    const turn = saveQueue.then(saveStateOnce);
+// record takes (withLock() in src/shared/browserApi.js), so no write by
-    // The queue must advance even when a save rejects, or every save after
+// another page or the background lands between its read and its write and is
-    // it queues behind a promise that never settles.
+// lost (https://git.eeqj.de/sneak/AutistMask/issues/641). A page in a Firefox
-    saveQueue = turn.catch(() => {});
+// private window is the exception: Firefox gives it locks of its own (README,
 // "Stored state and its version").
 //
 // The same lock orders this page's own saves. showView() calls saveState() on
 // every navigation without awaiting it, so two saves from one page can be
 // asked for at once; they take the lock in the order they were asked, and each
 // compares the page's state, as it stands once the stored record has been read
 // and `beforeWrite` has run, against the baseline the save before it left.
 //
 // `beforeWrite`, when given, is called inside the lock with the stored record
 // as just read, before this page's state is compared against it. It may change
 // `state`, and this save writes that change. When it returns false, nothing is
 // written; any other return lets the save go ahead.
 function saveState(beforeWrite) {
    const turn = withLock("autistmask", () => saveStateOnce(beforeWrite));
    // Every failed save is reported, whether or not the caller awaited this
    // one. The returned promise still rejects, so a caller that DOES await
    // keeps its own error handling.
@@ -595,6 +604,17 @@ function saveState() {
    return turn;
 }
 // Give this page the network switch held by `stored`, a record a save of this
 // page has just read (followStoredSettings() in src/popup/index.js calls this
 // from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
 // with a whole record. The switch is then not this page's own change, even when
 // that save fails to write: a later switch back to the previous network still
 // differs from `baseline`, and is stored.
 function takeStoredNetwork(stored) {
    copyChainSwitchFields(rawState, stored);
    copyChainSwitchFields(baseline, structuredClone(stored));
 }
 // Rejects with StateUnusableError for a stored record this build cannot make
 // sense of. Nothing is assigned and `loaded` stays false in that case, so a
 // caller that ignores the rejection gets StateNotLoadedError on the first
@@ -640,6 +660,7 @@ module.exports = {
    state,
    saveState,
    onSaveFailure,
    takeStoredNetwork,
    loadState,
    currentAddress,
    currentNetwork,
@@ -0,0 +1,27 @@
 // Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
 // profile.
 //
 // Before each request that sends the user's data to Blockscout or Etherscan, the
 // wallet reads that service's setting from storage. The wallet reads the setting
 // again when the answer lands. While the setting is off, no such request is
 // made, and an answer that lands after the setting went off is dropped. A page's
 // own copy of the setting is not used, because another page may have just
 // changed it.
 const { storageGet } = require("./browserApi");
 const { normalizePersisted } = require("./persistedState");
 // Whether the setting `name` is on in the stored profile. `name` is
 // "useBlockscout" or "checkRecipientsOnEtherscan". The profile is read through
 // normalizePersisted(), as a load reads it, so only a stored true is on. A
 // failed read counts as off.
 async function storedSettingIsOn(name) {
    try {
        const { autistmask } = await storageGet("autistmask");
        return normalizePersisted(autistmask)[name];
    } catch {
        return false;
    }
 }
 module.exports = { storedSettingIsOn };
@@ -20,6 +20,8 @@ const { toDecimals } = require("./transferAmount");
 // truncation without the approval screens' nonzero floor: the transaction
 // detail view is the authoritative record and already shows exact precision.
 const { truncateAmount: formatTxValue } = require("./amountDisplay");
 const { routerRelease } = require("./uniswap");
 const { storedSettingIsOn } = require("./storedSettings");
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -51,7 +53,6 @@ function parseTx(tx, addrLower, chainId) {
        }
        // Map known DEX methods to "Swap" for cleaner display
        const SWAP_METHODS = new Set([
            "execute",
            "swap",
            "swapExactTokensForTokens",
            "swapTokensForExactTokens",
@@ -59,9 +60,16 @@ function parseTx(tx, addrLower, chainId) {
            "swapTokensForExactETH",
            "swapExactTokensForETH",
            "swapETHForExactTokens",
            "multicall",
        ]);
-        const label = SWAP_METHODS.has(method)
+        // Multisigs, smart accounts and many other contracts also have an
        // `execute` or `multicall` method, so either is a swap only when sent
        // to a Universal Router on this transaction's network: the same
        // addresses the approval screen decodes a swap for.
        const isSwap =
            SWAP_METHODS.has(method) ||
            ((method === "execute" || method === "multicall") &&
                routerRelease(to, chainId) !== null);
        const label = isSwap
            ? "Swap"
            : method.charAt(0).toUpperCase() + method.slice(1);
        direction = "contract";
@@ -228,12 +236,17 @@ function mergeTransactions(txs, tokenTransfers) {
 // `chainId` is the chain id of the network `blockscoutUrl` serves. Every entry
 // carries it, and a native entry is labelled with that network's
 // `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
 //
 // While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
 // that lands after the setting went off is dropped
 // (src/shared/storedSettings.js). Either way the answer is an empty list.
 async function fetchRecentTransactions(
    address,
    blockscoutUrl,
    chainId,
    count = 25,
 ) {
    if (!(await storedSettingIsOn("useBlockscout"))) return [];
    log.debugf("fetchRecentTransactions", address);
    const addrLower = normalizeAddress(address);
@@ -264,6 +277,7 @@ async function fetchRecentTransactions(
    const txJson = txResp.ok ? await txResp.json() : {};
    const ttJson = ttResp.ok ? await ttResp.json() : {};
    if (!(await storedSettingIsOn("useBlockscout"))) return [];
    const txs = mergeTransactions(
        (txJson.items || []).map((tx) => parseTx(tx, addrLower, chainId)),
@@ -336,7 +336,8 @@ const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
 // currencies, and those commands may name one, so saying the calldata did not
 // name it would be false. The Paid to line uses it too, when a step may pay an
 // address this decoder did not read, and so do the lines for what a step
-// takes from the sender, when this decoder does not know it.
+// takes from the sender, when this decoder does not know it, and for what a
 // permit it could not read allows.
 const UNDECODED_CURRENCY = "Unknown (could not be decoded)";
 // The Paid to line for each token paid to the router, the swap's output or
@@ -494,8 +495,9 @@ function amountText(raw, info) {
    };
 }
-// The line giving a moved token under `label`, in the shape of the Token In
+// The line giving a moved token, or the token of a permit, under `label`, in
-// line, so the screens show it as they show that one. ETH has no address.
+// the shape of the Token In line, so the screens show it as they show that
 // one. ETH has no address.
 function tokenMovedLine(label, token, sources) {
    const info = tokenInfo(token, sources);
    if (!present(info.address)) {
@@ -527,6 +529,32 @@ function decodePermit2(input) {
    }
 }
 // Decode PERMIT2_PERMIT_BATCH (command 0x03) input bytes into the allowances
 // it grants, one for each token it names, all for its one spender, in the
 // shape decodePermit2() returns. Each release's
 // `contracts/base/Dispatcher.sol`, at the commit linked for it above, hands
 // Permit2 the batch in this shape.
 // ABI: (((address token, uint160 amount, uint48 expiration, uint48 nonce)[],
 //        address spender, uint256 sigDeadline), bytes signature)
 function decodePermit2Batch(input) {
    try {
        const d = coder.decode(
            [
                "tuple(tuple(address,uint160,uint48,uint48)[],address,uint256)",
                "bytes",
            ],
            input,
        );
        return d[0][0].map((details) => ({
            token: details[0],
            amount: details[1],
            spender: d[0][1],
        }));
    } catch {
        return null;
    }
 }
 // Decode BALANCE_CHECK_ERC20 (command 0x0e) input bytes. The router passes the
 // check when `owner` holds at least `minBalance` of `token`, and reads `owner`
 // as written, without map(), on every release that has the command:
@@ -596,12 +624,14 @@ function decodeV2SwapExactOut(input) {
 // token(20) ...), or null when it is not one token followed by whole hops of
 // a fee and a token (40 hex digits, then 46 per hop). The router reads only
 // whole hops and ignores any bytes after the last one, so the last 20 bytes
-// of such a path are not the token it reads there.
+// of such a path are not the token it reads there. Both are checksummed, as
 // the ABI decoder gives every other address, so a token reads the same on
 // every line.
 function decodeV3Path(pathHex) {
    const hex = pathHex.startsWith("0x") ? pathHex.slice(2) : pathHex;
    if (hex.length < 40 || (hex.length - 40) % 46 !== 0) return null;
-    const first = "0x" + hex.slice(0, 40);
+    const first = getAddress("0x" + hex.slice(0, 40));
-    const last = "0x" + hex.slice(-40);
+    const last = getAddress("0x" + hex.slice(-40));
    return { first, last };
 }
@@ -923,7 +953,9 @@ function totalAmount(amounts) {
 // 2. Amount is the amountIn of the swap action that spends Token In. If
 //    several exact-in actions spend it, each with a stated amount, it is
 //    their sum; in any other case there is none. Min. received is the same
-//    for amountOutMin and the actions that buy Token Out.
+//    for amountOutMin and the actions that buy Token Out, except that there
 //    is none when a swap action in the step also spends Token Out: the step
 //    then does not pay out all that those actions buy.
 // 3. If any swap action in the step cannot be read, only SETTLE, SETTLE_ALL,
 //    TAKE and TAKE_ALL name the sides, and there is no Amount or Min.
 //    received.
@@ -1157,11 +1189,13 @@ function decodeV4Swap(input) {
        const boughtOnly = currenciesNotIn(bought, spent);
        if (present(takeToken) || boughtOnly.length === 1) {
            tokenOut = present(takeToken) ? takeToken : boughtOnly[0];
-            amountOutMin = totalAmount(
+            if (!spent.includes(tokenOut)) {
-                swaps
+                amountOutMin = totalAmount(
-                    .filter((s) => s.tokenOut === tokenOut)
+                    swaps
-                    .map((s) => s.amountOutMin),
+                        .filter((s) => s.tokenOut === tokenOut)
-            );
+                        .map((s) => s.amountOutMin),
                );
            }
        }
        return {
@@ -1204,13 +1238,22 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        let inputToken = null;
        let inputAmount = null;
        let inputEstablished = false;
-        // Whether the user pays the V4 step that set the input side any of
+        // Whether the user pays the step that set the input side: a V2 or V3
-        // its input currency (see decodeV4Swap()). Only a V4 step can set the
+        // swap step with `payerIsUser` true, a V4 step the user pays some of
-        // input side with no amount, the one case in which this is read.
+        // its input currency (see decodeV4Swap()), or a WRAP_ETH, whose ETH
        // comes from the transaction's value. A step paid from the router
        // takes nothing from the sender.
        let inputPaidByUser = false;
-        // The last PERMIT2_PERMIT this decoder read, or null (see
+        // The last PERMIT2_PERMIT this decoder read before a step set the
-        // permitStands after the loop).
+        // input side, or null (see permitStands after the loop).
        let permit = null;
        // Every allowance a PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH grants,
        // before a step set the input side or after, in step order, as
        // { token, amount, spender, step }. A permit or batch whose input
        // this decoder cannot read is one with a null token, amount and
        // spender. Each but a permit whose amount is the Amount figure gets
        // lines of its own (see after the PERMIT2_TRANSFER_FROM lines).
        const permits = [];
        // The index of each step this decoder did not read in full: a
        // command it does not read, a step whose input it cannot read, in
        // whole or in part, and one it fails on (see permitStands).
@@ -1219,6 +1262,31 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        let minOutput = null;
        let outputEstablished = false;
        let hasUnwrapWeth = false;
        // Set when an UNWRAP_WETH pays out, as ETH, the output side's WETH,
        // which the router holds; cleared whenever the output side is set
        // again, or a later step may pay that ETH out as WETH (see after the
        // loop). `unwrapIntoRouterStep` is the index of the first such
        // UNWRAP_WETH that may have paid the ETH to the router, which then
        // holds it: its recipient is the router or cannot be read. A later
        // UNWRAP_WETH does not replace it. It is null when there is none, and
        // is cleared with `outputUnwrapped` when the output side is set again.
        let outputUnwrapped = false;
        let unwrapIntoRouterStep = null;
        // The index of the step that set the output side.
        let outputStep = -1;
        // The index of the last step this decoder treats as one that may take
        // WETH out of the router or pay anyone WETH: any step but one it read
        // that is a PERMIT2_PERMIT, a BALANCE_CHECK_ERC20, or a SWEEP,
        // TRANSFER, PAY_PORTION or PAY_PORTION_FULL_PRECISION of a token
        // other than WETH, and not of ETH to a WETH contract, which pays the
        // router WETH (see keepsRouterWeth in the loop). None of those can.
        let lastWethStep = -1;
        // Where the step that set the output side paid its output: the
        // recipient of a swap step, as written, or of each TAKE, TAKE_ALL and
        // TAKE_PORTION of it in a V4 step, a TAKE_ALL as paid to the sender,
        // with null for a payout of that step this decoder did not read. A
        // BALANCE_CHECK_ERC20 pays nobody.
        let outputRecipients = [];
        let hasV2OrV3ExactOut = false;
        let swapUndecoded = false;
        let hasSubPlan = false;
@@ -1243,8 +1311,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        // when no earlier hop set it. A half the establishing hop did not
        // state stays null and the line says so, rather than being filled in
        // from a different hop. A PERMIT2_PERMIT sets no side here: after the
-        // loop, the last one read names Token In, and the Amount line is
+        // loop, one whose amount stands as the Amount figure names Token In,
-        // formed there, in one place (see permitStands).
+        // and the Amount line is formed there, in one place (see
        // permitStands).
        const setInput = (token, amount) => {
            inputToken = present(token) ? token : null;
            inputAmount = present(amount) ? amount : null;
@@ -1255,11 +1324,15 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
            if (!present(token) && !present(amount)) return;
            setInput(token, amount);
        };
-        const setOutput = (token, amount) => {
+        const setOutput = (step, token, amount, recipients) => {
            if (!present(token) && !present(amount)) return;
            outputToken = present(token) ? token : null;
            minOutput = present(amount) ? amount : null;
            outputEstablished = true;
            outputUnwrapped = false;
            unwrapIntoRouterStep = null;
            outputRecipients = recipients;
            outputStep = step;
        };
        // What the steps take from the sender beyond the amount of the step
@@ -1284,6 +1357,15 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        const spentUnread = () => {
            userPaid.push({ token: null, amount: null });
        };
        // A PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH at `step` whose input this
        // decoder cannot read may let any spender take any amount of any
        // token: one line says so, there is no Amount line, whose figure may
        // then be too low, and the minimum reads Min. paid out (see
        // toAnotherSpender).
        const permitUnread = (step) => {
            permits.push({ token: null, amount: null, spender: null, step });
            stepsUnread.push(step);
        };
        // Who the steps pay, in whichever step and of whatever token.
        // MSG_SENDER is the sender. The router itself, as ADDRESS_THIS or by
@@ -1393,6 +1475,14 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    v2PairFor(chainId, next.path[0], next.path[1]).toLowerCase()
            );
        };
        // Whether a SWEEP, TRANSFER, PAY_PORTION or PAY_PORTION_FULL_PRECISION
        // of `token` to `recipient` pays anyone WETH (see lastWethStep): it
        // does when `token` is WETH, and when it pays ETH to a WETH contract,
        // which pays the router WETH for it.
        const paysWeth = (token, recipient) =>
            WETH_ADDRESSES.includes(token.toLowerCase()) ||
            (token === "0x0000000000000000000000000000000000000000" &&
                WETH_ADDRESSES.includes(recipient.toLowerCase()));
        for (let i = 0; i < commandsBytes.length; i++) {
            const cmdId = commandsBytes[i] & commandTypeMask;
@@ -1409,6 +1499,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    ? COMMAND_NAMES[command]
                    : "Command 0x" + cmdId.toString(16).padStart(2, "0"),
            );
            // Set by a branch below that reads a step that cannot take WETH
            // out of the router or pay anyone WETH (see lastWethStep).
            let keepsRouterWeth = false;
            try {
                if (command === "EXECUTE_SUB_PLAN") {
@@ -1425,23 +1518,44 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                } else if (command === "PERMIT2_PERMIT") {
                    const p = decodePermit2(inputs[i]);
                    if (p) {
                        permits.push({ ...p, step: i });
                        keepsRouterWeth = true;
                    } else {
                        permitUnread(i);
                    }
                    // Only a permit whose amount stands as the Amount figure
                    // names Token In (see permitStands). Every other permit,
                    // before the step that sets the input side or after it,
                    // leaves Token In and Amount as they read with no permit
                    // and gets lines of its own. One after a step set the input
                    // side never stands, so only one before it is kept here.
                    if (p && !inputEstablished) {
                        // Whether a step before it took its token, or may
-                        // have: the step that set the input side or one in
+                        // have: one in `userPaid`, `movedIntoRouter` or
-                        // `userPaid`, when its token is the permit's or not
+                        // `movedFromSender`, when its token is the permit's
-                        // known.
+                        // or not known. No step has set the input side yet.
                        const mayBeItsToken = (token) =>
                            !present(token) || sameAddress(token, p.token);
-                        const tookBefore =
+                        const tookBefore = [
-                            (inputEstablished && mayBeItsToken(inputToken)) ||
+                            ...userPaid,
-                            userPaid.some((t) => mayBeItsToken(t.token));
+                            ...movedIntoRouter,
                            ...movedFromSender,
                        ].some((t) => mayBeItsToken(t.token));
                        permit = {
                            ...p,
                            step: i,
                            allowedToFail,
                            beforeEveryTake: !tookBefore,
                        };
                    }
                } else if (command === "PERMIT2_PERMIT_BATCH") {
                    // Each allowance it grants gets the lines of a permit
                    // whose amount does not stand. It pays nobody.
                    const batch = decodePermit2Batch(inputs[i]);
                    if (batch) {
                        permits.push(...batch.map((p) => ({ ...p, step: i })));
                    } else {
-                        stepsUnread.push(i);
+                        permitUnread(i);
                    }
                } else if (command === "PERMIT2_TRANSFER_FROM") {
                    const p = decodePermit2TransferFrom(inputs[i]);
@@ -1495,6 +1609,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        // what the user receives: it sets no side, and the
                        // step says so.
                        commandNames[i] += " (of another address)";
                        keepsRouterWeth = true;
                    } else {
                        // The router passes this check whenever the owner
                        // holds at least minBalance, so a zero one guarantees
@@ -1505,21 +1620,23 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        // does. It pays nobody.
                        const minBalance = allowedToFail ? 0n : b.minBalance;
                        if (!(minBalance === 0n && present(minOutput))) {
-                            setOutput(b.token, minBalance);
+                            setOutput(i, b.token, minBalance, []);
                        }
                        keepsRouterWeth = true;
                    }
                } else if (command === "V3_SWAP_EXACT_IN") {
                    const s = decodeV3SwapExactIn(inputs[i]);
                    if (s) {
                        if (!inputEstablished) {
                            setInputOnce(s.tokenIn, s.amountIn);
                            inputPaidByUser = s.payerIsUser;
                        } else if (s.payerIsUser) {
                            addUserPaid(s.tokenIn, s.amountIn);
                        }
                        // Always update output: in multi-step swaps (V3 → V4),
                        // the last swap step determines the final output token
                        // and minimum received amount.
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        setOutput(i, s.tokenOut, s.amountOutMin, [s.recipient]);
                        if (!s.payerIsUser) {
                            spendFromRouter(s.tokenIn, s.amountIn);
                        }
@@ -1536,10 +1653,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    if (s) {
                        if (!inputEstablished) {
                            setInputOnce(s.tokenIn, s.amountIn);
                            inputPaidByUser = s.payerIsUser;
                        } else if (s.payerIsUser) {
                            addUserPaid(s.tokenIn, s.amountIn);
                        }
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        setOutput(i, s.tokenOut, s.amountOutMin, [s.recipient]);
                        if (!s.payerIsUser) {
                            spendFromRouter(s.tokenIn, s.amountIn);
                        }
@@ -1567,10 +1685,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    if (s) {
                        if (!inputEstablished) {
                            setInputOnce(s.tokenIn, s.amountInMax);
                            inputPaidByUser = s.payerIsUser;
                        } else if (s.payerIsUser) {
                            addUserPaid(s.tokenIn, s.amountInMax);
                        }
-                        setOutput(s.tokenOut, s.amountOut);
+                        setOutput(i, s.tokenOut, s.amountOut, [s.recipient]);
                        if (!isHop(i, s.tokenOut, s.recipient)) {
                            addPayee(s.recipient, s.tokenOut);
                        }
@@ -1592,6 +1711,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        if (!isRouter(s.recipient)) {
                            heldByRouter.delete(s.token.toLowerCase());
                        }
                        keepsRouterWeth = !paysWeth(s.token, s.recipient);
                    } else {
                        payeeUnread = true;
                        stepsUnread.push(i);
@@ -1629,6 +1749,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        ) {
                            heldByRouter.delete(t.token.toLowerCase());
                        }
                        keepsRouterWeth = !paysWeth(t.token, t.recipient);
                    } else {
                        payeeUnread = true;
                        stepsUnread.push(i);
@@ -1660,10 +1781,13 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                } else if (command === "WRAP_ETH") {
                    const w = decodeWrapEth(inputs[i]);
                    if (w) {
-                        setInputOnce(
+                        if (!inputEstablished) {
-                            "0x0000000000000000000000000000000000000000",
+                            setInputOnce(
-                            w.amount,
+                                "0x0000000000000000000000000000000000000000",
-                        );
+                                w.amount,
                            );
                            inputPaidByUser = true;
                        }
                        addPayee(w.recipient);
                        // CONTRACT_BALANCE wraps all the router's ETH.
                        if (w.amount === CONTRACT_BALANCE) {
@@ -1728,6 +1852,14 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        (p) => p.currency === v4.tokenIn,
                    );
                    const amountIn = paidIn ? paidIn.amount : v4?.amountIn;
                    // Where the step pays its output, if it sets the output
                    // side (see outputRecipients).
                    const takeRecipients = v4
                        ? v4.takes
                              .filter((t) => t.currency === v4.tokenOut)
                              .map((t) => t.recipient)
                              .concat(v4.recipientUnread ? [null] : [])
                        : [];
                    if (v4 && v4.hasSwapAction) {
                        // A step with a swap action always sets the output
                        // side, as the last swap step wins, and sets the
@@ -1744,13 +1876,22 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                        outputToken = v4.tokenOut;
                        minOutput = v4.amountOutMin;
                        outputEstablished = true;
                        outputUnwrapped = false;
                        unwrapIntoRouterStep = null;
                        outputRecipients = takeRecipients;
                        outputStep = i;
                    } else if (v4) {
                        // A step with no swap action sets only the sides its
                        // SETTLE, SETTLE_ALL, TAKE or TAKE_ALL names:
                        // setInputOnce() and setOutput() leave alone a side
                        // whose two halves are both unstated.
                        setInputOnce(v4.tokenIn, amountIn);
-                        setOutput(v4.tokenOut, v4.amountOutMin);
+                        setOutput(
                            i,
                            v4.tokenOut,
                            v4.amountOutMin,
                            takeRecipients,
                        );
                    }
                    // Every V4 step, with a swap action or without, takes
                    // from the sender what the user pays it (an amount an
@@ -1772,7 +1913,43 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    }
                } else if (command === "UNWRAP_WETH") {
                    hasUnwrapWeth = true;
                    // The router unwraps all the WETH it holds, even when the
                    // recipient cannot be read. The output side's WETH is
                    // among it when the step that set the output side paid it
                    // to the router and the router still holds WETH. WETH
                    // that step paid to the user, or to anyone else, stays
                    // WETH. When that step also paid some of its output
                    // elsewhere or made a payout this decoder did not read,
                    // or this decoder treats a step between the two as one
                    // that may take WETH out of the router or pay anyone WETH
                    // (see lastWethStep), the WETH unwrapped may be only part
                    // of the output side's, or none of it.
                    // This decoder does not count how much of that step's
                    // minimum then reaches the UNWRAP_WETH, nor read the
                    // UNWRAP_WETH's own minimum, so the output side keeps no
                    // figure.
                    const u = decodeUnwrapWeth(inputs[i]);
                    const toRouter = (r) => present(r) && isRouter(r);
                    if (
                        present(outputToken) &&
                        WETH_ADDRESSES.includes(outputToken.toLowerCase()) &&
                        heldByRouter.has(outputToken.toLowerCase()) &&
                        outputRecipients.some(toRouter)
                    ) {
                        outputUnwrapped = true;
                        if (
                            unwrapIntoRouterStep === null &&
                            (u === null || isRouter(u.recipient))
                        ) {
                            unwrapIntoRouterStep = i;
                        }
                        if (
                            !outputRecipients.every(toRouter) ||
                            lastWethStep > outputStep
                        ) {
                            minOutput = null;
                        }
                    }
                    if (u) {
                        addPayee(u.recipient);
                        // It pays out all the router's WETH, as ETH. Into the
@@ -1794,8 +1971,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                    }
                } else {
                    // Any other step may pay an address this decoder does not
-                    // read: PERMIT2_PERMIT_BATCH and the NFT commands among
+                    // read: the NFT commands among them, and a type the
-                    // them, and a type the release names no command for.
+                    // release names no command for.
                    payeeUnread = true;
                    stepsUnread.push(i);
                }
@@ -1809,6 +1986,26 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
            if (allowedToFail) {
                commandNames[i] += " (allowed to fail)";
            }
            if (!keepsRouterWeth) {
                lastWethStep = i;
            }
        }
        // After an UNWRAP_WETH that may have paid the output side's WETH to
        // the router as ETH, a later step may pay that ETH out as WETH, as a
        // WRAP_ETH of it to the user does. This decoder treats every later
        // step but those lastWethStep names as one that may, and does not
        // count how much of that ETH each pays out: after one, the output
        // side reads as WETH with no figure. Neither this nor the loss of the
        // figure in the UNWRAP_WETH branch is undone by any later step, a
        // later UNWRAP_WETH included, but one that sets the output side again.
        if (
            outputUnwrapped &&
            unwrapIntoRouterStep !== null &&
            lastWethStep > unwrapIntoRouterStep
        ) {
            outputUnwrapped = false;
            minOutput = null;
        }
        // The Amount line, and the lines for what the steps take beyond it.
@@ -1821,18 +2018,26 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        // lines of its own. One whose amount is not known also leaves the
        // total unknown, with no figure.
        //
-        // The last PERMIT2_PERMIT read names Token In. Its amount stands as
+        // A PERMIT2_PERMIT names Token In only when its amount stands as the
-        // the Amount figure in place of the total only in the plain shape of
+        // Amount figure in place of the total, which it does only in the
-        // Uniswap's own routes: it is the only PERMIT2_PERMIT, its spender is
+        // plain shape of Uniswap's own routes: it comes before the step that
        // set the input side, it is the only PERMIT2_PERMIT in the
        // transaction and there is no PERMIT2_PERMIT_BATCH, its spender is
        // the router, the router may not let it fail, no step before it took
-        // its token or one not known, and this decoder read every step after
+        // its token or one not known (a PERMIT2_TRANSFER_FROM of its token
-        // it in full (see stepsUnread). Permit2 then lets the router take no
+        // included), and this decoder read every step after it in full (see
-        // more of the token than that amount, so the permit covers every take
+        // stepsUnread). Permit2 then lets the router take no more of the token
-        // of it. A later step this decoder did not read may raise what Permit2
+        // than that amount, so the permit covers every take of it. A step
-        // lets the router take, as a PERMIT2_PERMIT_BATCH can. A step that
+        // before it takes under whatever allowance the router already had, so
-        // may take from the sender what this decoder did not read leaves no
+        // it may take more. A later permit or batch, or a later step this
-        // figure, permit or not (see spentUnread()), and an EXECUTE_SUB_PLAN
+        // decoder did not read, may raise what Permit2 lets the router take.
-        // step leaves both sides unknown (below).
+        // Every other PERMIT2_PERMIT leaves Token In and the Amount line as
        // they read with no permit, and gets lines of its own below. A step
        // that may take from the sender what this decoder did not read leaves
        // no figure, permit or not (see spentUnread()), and so do a permit
        // or batch whose input it cannot read (see permitUnread()) and an
        // allowance of Token In to another spender (see toAnotherSpender). An
        // EXECUTE_SUB_PLAN step leaves both sides unknown (below).
        const stepCommands = Array.from(
            commandsBytes,
            (b) => commands[b & commandTypeMask],
@@ -1840,6 +2045,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        const permitStands =
            permit !== null &&
            stepCommands.filter((c) => c === "PERMIT2_PERMIT").length === 1 &&
            !stepCommands.includes("PERMIT2_PERMIT_BATCH") &&
            sameAddress(permit.spender, toAddress) &&
            !permit.allowedToFail &&
            permit.beforeEveryTake &&
@@ -1849,6 +2055,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        // (see spentUnread()), or a token it does not know.
        const spentFromSender = [];
        let total = null;
        // The takes from the sender that `total` adds up, each a quantity, as
        // { token, amount }. When there is no Amount line, each gets lines of
        // its own (see below). The amount of a step that set the input side
        // and is paid from the router counts in `total` but is not among them.
        const inTotal = [];
        // Whether the step that set the input side counts as a take from the
        // sender, which may get lines of its own. The amount it stated counts
        // whoever pays it. Stating none, it counts only when the user pays it
@@ -1859,17 +2070,20 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        // The take of the step that set the input side, when the total
        // starts from it and it stated no amount (see below), or null.
        let firstTakeUnstated = null;
-        if (permit === null || sameAddress(inputToken, permit.token)) {
+        if (!permitStands || sameAddress(inputToken, permit.token)) {
            total = inputAmount;
            if (typeof inputAmount === "bigint" && inputPaidByUser) {
                inTotal.push({ token: inputToken, amount: inputAmount });
            }
            if (hasFirstTake && !present(inputAmount)) {
                firstTakeUnstated = { token: inputToken, amount: null };
            }
        } else if (hasFirstTake) {
            // The step that set the input side spent a token other than the
-            // permit's, or one not known, so the total starts with no figure.
+            // permit's, or one not known, so its amount gets lines of its own.
            spentFromSender.push({ token: inputToken, amount: inputAmount });
        }
-        if (permit !== null) inputToken = permit.token;
+        if (permitStands) inputToken = permit.token;
        for (const t of userPaid) {
            const ofTokenIn = sameAddress(t.token, inputToken);
            if (ofTokenIn && permitStands) continue;
@@ -1879,6 +2093,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                typeof t.amount === "bigint"
            ) {
                total += t.amount;
                inTotal.push(t);
                continue;
            }
            spentFromSender.push(t);
@@ -1902,33 +2117,31 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        }
        // The commands of an EXECUTE_SUB_PLAN step may spend the user's tokens
-        // or pay the user, before or after any other step, and a permit among
+        // or pay the user, before or after any other step. What the other
-        // them would name Token In. What the other steps state is
+        // steps state is then not the whole swap, so both sides are set
-        // then not the whole swap, so both sides are set unknown, with no
+        // unknown, with no figure, wherever the step stands.
        // figure, wherever the step stands.
        if (hasSubPlan) {
            inputToken = null;
            inputAmount = null;
            outputToken = null;
            minOutput = null;
            outputEstablished = true;
            outputUnwrapped = false;
        }
        // Resolve token info. A null token on either side means no step named
        // a currency for it, a V4 step with a swap action left it unknown, or
        // an EXECUTE_SUB_PLAN step did; tokenInfo() refuses rather than calling
        // it ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
-        // when the output side is WETH, or when no step set the output side. A
+        // when it unwraps the output side's WETH (`outputUnwrapped`), or when
-        // V4 step with a swap action, or an EXECUTE_SUB_PLAN step, did set it,
+        // no step set the output side. A V4 step with a swap action, or
-        // even when it set it unknown. Any other output keeps its own token
+        // an EXECUTE_SUB_PLAN step, did set it, even when it set it unknown.
-        // and figure: a swap that buys USDC and then unwraps the WETH it did
+        // Any other output keeps its own token and figure: a swap that pays
-        // not spend receives USDC.
+        // its WETH to the user and then unwraps receives WETH, and one that
-        const outputIsWeth =
+        // buys USDC and then unwraps the WETH it did not spend receives USDC.
            present(outputToken) &&
            WETH_ADDRESSES.includes(outputToken.toLowerCase());
        const inInfo = tokenInfo(inputToken, sources);
        const outInfo =
-            hasUnwrapWeth && (outputIsWeth || !outputEstablished)
+            outputUnwrapped || (hasUnwrapWeth && !outputEstablished)
                ? { symbol: "ETH", decimals: 18, address: null }
                : tokenInfo(outputToken, sources);
@@ -2009,12 +2222,30 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
            return amountText(amount, info);
        };
        // Each allowance to a spender other than the router. Code that a step
        // runs, such as a V4 pool's hook or a token's own code, can call that
        // spender, which can then take up to the allowance from the sender
        // before the transaction ends. A permit or batch this decoder could
        // not read may be to any spender, of any token.
        const toAnotherSpender = permits.filter(
            (p) => !sameAddress(p.spender, toAddress),
        );
        // A null token in `spentFromSender`, a step this decoder did not read
-        // or a token it does not know, leaves no Amount figure, which may
+        // or a token it does not know, and an allowance to another spender
-        // then be too low.
+        // that may be of Token In, leave no Amount figure, which may then be
        // too low. With no Amount line, each take the total adds up gets
        // lines of its own, first, so that every amount this decoder read is
        // shown.
        if (
            present(inputAmount) &&
-            spentFromSender.every((s) => present(s.token))
+            spentFromSender.every((s) => present(s.token)) &&
            toAnotherSpender.every(
                (p) =>
                    present(p.token) &&
                    present(inputToken) &&
                    !sameAddress(p.token, inputToken),
            )
        ) {
            const amount = spentText(inputAmount, inInfo);
            details.push({
@@ -2022,6 +2253,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                value: amount.display,
                rawValue: amount.raw,
            });
        } else {
            spentFromSender.unshift(...inTotal);
        }
        // What steps take from the sender beyond the Amount line, in the shape
@@ -2064,6 +2297,40 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
            );
        }
        // What each allowance of a PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH lets
        // its spender take: its amount, its token and the spender, an address
        // on a line of its own. Permit2's maximum is unbounded. Only a permit
        // whose amount stands as the Amount figure (see permitStands) gets
        // none: that line already gives its amount and Token In its token,
        // and its spender is the router. Every other allowance, one after the
        // step that set the input side included, gets these lines, so nothing
        // it lets anyone take goes unstated. A permit or batch this decoder
        // could not read gets one line saying so.
        for (const p of permits) {
            if (permitStands && p.step === permit.step) continue;
            if (!present(p.token)) {
                details.push({
                    label: "Permit2 allowance",
                    value: UNDECODED_CURRENCY,
                });
                continue;
            }
            details.push({
                label: "Permit2 allowance",
                value:
                    p.amount >= MAX_UINT160
                        ? "Unlimited"
                        : amountText(p.amount, tokenInfo(p.token, sources))
                              .display,
            });
            details.push(tokenMovedLine("Allowance token", p.token, sources));
            details.push({
                label: "Allowance spender",
                value: p.spender,
                address: p.spender,
            });
        }
        // Keyed on the address, not the symbol: a token absent from the
        // bundled list has no symbol, and gating the line on one dropped it
        // entirely, leaving a Min. received figure with nothing saying what is
@@ -2099,9 +2366,10 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        // step pays the bridge, when one moves the sender's tokens into the
        // router, when a token stays in the router, and when a payout could
        // not be read. The output is received by the sender only when some
-        // step pays the sender and there is no such line. When no step names
+        // step pays the sender, there is no such line, and no allowance goes
-        // anyone paid, one line says so. `paidTo` holds these lines and the
+        // to another spender (see toAnotherSpender). When no step names anyone
-        // token line after each line about a token in the router.
+        // paid, one line says so. `paidTo` holds these lines and the token
        // line after each line about a token in the router.
        const outputHeld =
            present(outputToken) && heldByRouter.has(outputToken.toLowerCase());
        const paidTo = paidElsewhere.map((address) => ({
@@ -2148,7 +2416,10 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
        if (payeeUnread) {
            paidTo.push({ label: "Paid to", value: UNDECODED_CURRENCY });
        }
-        const received = paidToSender && paidTo.length === 0;
+        const received =
            paidToSender &&
            paidTo.length === 0 &&
            toAnotherSpender.length === 0;
        if (!paidToSender && paidTo.length === 0) {
            paidTo.push({ label: "Paid to", value: UNNAMED_CURRENCY });
        }
@@ -2193,4 +2464,4 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
    }
 }
-module.exports = { decode };
+module.exports = { decode, routerRelease };
@@ -41,6 +41,8 @@ jest.mock("../src/shared/balances", () => ({
    refreshBalances: jest.fn(async () => {
        mockBalanceRefreshAt.push(Date.now());
    }),
    dropUntrackedTokens: jest.requireActual("../src/shared/balances")
        .dropUntrackedTokens,
    getProvider: jest.fn(() => ({})),
 }));
@@ -84,6 +84,9 @@ function walletsHolding(token, decimals) {
 beforeEach(() => {
    state.trackedTokens = [];
    state.wallets = [];
    // The approval screen reads the explorer's report only while "Use
    // Blockscout" is on.
    state.useBlockscout = true;
 });
 describe("resolveTokenDecimals", () => {
@@ -0,0 +1,308 @@
 // While "Use Blockscout" is off, the approval screens, and the screens that
 // follow TxApproval, take a token's name and scale from the bundled list and
 // the tracked tokens alone (https://git.eeqj.de/sneak/AutistMask/issues/668).
 // A token missing from both gets a line under it. The line says Blockscout's
 // report of the user's balances is not used to name the token. While the
 // setting is on, Blockscout's report of the user's holding is a source too, as
 // before.
 //
 // Booted through the real popup entry point, as the approval window or as a
 // popup reopened onto SuccessTx, WaitTx or ErrorTx. The vault is mocked so that
 // no password has to be hashed: the stored secret decrypts to the test key
 // below.
 jest.mock("../src/shared/vault", () => ({
    decryptWithPassword: jest.fn(),
    encryptWithPassword: jest.fn(),
 }));
 const { Interface, Wallet } = require("ethers");
 const {
    bootPopup,
    cleanupPopup,
    unversionedValidProfile,
 } = require("./support/popupBoot");
 // A published test key, never used for real funds.
 const SIGNER_KEY =
    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
 const signer = new Wallet(SIGNER_KEY);
 const ORIGIN = "https://dapp.example";
 const RECIPIENT = "0x2222222222222222222222222222222222222222";
 const TX_HASH = "0x" + "ab".repeat(32);
 // Outside the bundled list, and not tracked.
 const TOKEN = "0xE2E0000000000000000000000000000000000E2e";
 // In the bundled list, at 6 decimals.
 const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
 const LINE =
    'Blockscout\'s report of your balances is not used to name this token, because "Use Blockscout" is off in Settings.';
 // TOKEN as Blockscout reports the user's holding of it.
 const TOKEN_ROW = {
    address: TOKEN,
    name: "Novel",
    symbol: "NOVEL",
    decimals: "6",
    balance: "5000.0",
    holders: 5000,
 };
 // A transfer of 5,000 of a 6-decimal token to RECIPIENT.
 const TRANSFER_DATA = new Interface([
    "function transfer(address to, uint256 amount)",
 ]).encodeFunctionData("transfer", [RECIPIENT, 5000000000n]);
 // An EIP-2612 permit letting RECIPIENT take 5,000 of TOKEN.
 const PERMIT = {
    types: {
        EIP712Domain: [
            { name: "name", type: "string" },
            { name: "chainId", type: "uint256" },
            { name: "verifyingContract", type: "address" },
        ],
        Permit: [
            { name: "owner", type: "address" },
            { name: "spender", type: "address" },
            { name: "value", type: "uint256" },
            { name: "nonce", type: "uint256" },
            { name: "deadline", type: "uint256" },
        ],
    },
    primaryType: "Permit",
    domain: { name: "Novel", chainId: 1, verifyingContract: TOKEN },
    message: {
        owner: signer.address,
        spender: RECIPIENT,
        value: "5000000000",
        nonce: "0",
        deadline: "1790000000",
    },
 };
 // The stored profile: the user's one address holds `tokenBalances`.
 function profile(useBlockscout, tokenBalances, extra) {
    return unversionedValidProfile({
        useBlockscout,
        wallets: [
            {
                type: "key",
                name: "Wallet 1",
                encryptedSecret: "encrypted-key",
                addresses: [
                    {
                        address: signer.address,
                        balance: "1.0",
                        tokenBalances,
                    },
                ],
            },
        ],
        activeAddress: signer.address,
        allowedSites: { [signer.address]: [ORIGIN] },
        ...extra,
    });
 }
 // The approval window for the site's request. The request is a transfer sent to
 // `token`, or a signature request when `signParams` is given. The background
 // answers the signed transaction with `txResponse`.
 function bootApproval(stored, { token = TOKEN, signParams, txResponse } = {}) {
    return bootPopup(stored, {
        search: "?approval=approval-1",
        runtime: {
            connect: () => ({ postMessage: () => {} }),
            sendMessage: (msg, reply) => {
                if (msg.type === "AUTISTMASK_GET_APPROVAL") {
                    reply({
                        type: signParams ? "sign" : "tx",
                        origin: ORIGIN,
                        isPhishingDomain: false,
                        approvedFrom: signer.address,
                        signParams,
                        approvedTx: {
                            type: 2,
                            from: signer.address,
                            chainId: "0x1",
                            nonce: "0x7",
                            gasLimit: "0x30d40",
                            maxPriorityFeePerGas: "0x3b9aca00",
                            maxFeePerGas: "0x77359400",
                            to: token,
                            value: "0x0",
                            data: TRANSFER_DATA,
                            accessList: [],
                        },
                    });
                } else if (msg.type === "AUTISTMASK_TX_RESPONSE") {
                    reply(txResponse);
                } else {
                    reply(undefined);
                }
            },
        },
    });
 }
 beforeEach(() => {
    // The page logs its failed RPC reads; the stub node in popupBoot.js
    // answers none.
    jest.spyOn(console, "error").mockImplementation(() => {});
 });
 afterEach(() => {
    cleanupPopup();
    jest.restoreAllMocks();
 });
 describe("TxApproval", () => {
    test("has the line under a token it cannot name while Use Blockscout is off", async () => {
        const page = await bootApproval(profile(false, []));
        const details = page.node("approve-tx-decoded-details").innerHTML;
        expect(details).toContain("Unknown token");
        expect(details).toContain(LINE);
        expect(details).toContain("5000000000 base units (decimals unknown)");
        cleanupPopup();
        // The bundled list names USDC, so there is nothing to say.
        const bundled = await bootApproval(profile(false, []), {
            token: USDC,
        });
        expect(
            bundled.node("approve-tx-decoded-details").innerHTML,
        ).not.toContain(LINE);
        cleanupPopup();
        const on = await bootApproval(profile(true, [TOKEN_ROW]));
        const named = on.node("approve-tx-decoded-details").innerHTML;
        expect(named).toContain("5000.0000 NOVEL");
        expect(named).not.toContain(LINE);
    });
    test("names nothing from a Blockscout entry still in the balances while Use Blockscout is off", async () => {
        const page = await bootApproval(profile(false, [TOKEN_ROW]));
        const details = page.node("approve-tx-decoded-details").innerHTML;
        expect(details).not.toContain("NOVEL");
        expect(details).toContain("Unknown token");
        expect(details).toContain(LINE);
    });
    test.each([
        ["WaitTx", { txHash: TX_HASH }, "wait-tx"],
        [
            "ErrorTx",
            { error: "The transaction could not be sent.", retryable: false },
            "error-tx",
        ],
    ])(
        "%s after it says so under the amount while Use Blockscout is off",
        async (_name, txResponse, view) => {
            const page = await bootApproval(profile(false, []), {
                txResponse,
            });
            const { decryptWithPassword } = require("../src/shared/vault");
            decryptWithPassword.mockResolvedValue(SIGNER_KEY);
            page.node("approve-tx-password").value = "any password";
            await page.click("btn-approve-tx");
            expect(page.visibleViews()).toEqual([view]);
            expect(page.node(view + "-token-note").innerHTML).toBe(
                `<div class="text-xs text-muted">${LINE}</div>`,
            );
        },
    );
 });
 test("SuccessTx says so under the decoded token while Use Blockscout is off", async () => {
    const page = await bootPopup(
        profile(false, [], {
            currentView: "success-tx",
            viewStack: ["main"],
            viewData: {
                amount: "5000000000 base units (decimals unknown)",
                symbol: "?",
                to: RECIPIENT,
                hash: TX_HASH,
                blockNumber: 21000000,
                chainId: "0x1",
                decoded: {
                    name: "Token Transfer",
                    description: "Transfer ERC-20 token",
                    details: [
                        {
                            label: "Token",
                            value: TOKEN,
                            address: TOKEN,
                            isToken: true,
                        },
                    ],
                },
            },
        }),
    );
    expect(page.visibleViews()).toEqual(["success-tx"]);
    const decoded = page.node("success-tx-decoded").innerHTML;
    expect(decoded).toContain("Unknown token");
    expect(decoded).toContain(LINE);
 });
 test.each([
    [
        "wait-tx",
        {
            pendingWait: {
                hash: TX_HASH,
                txInfo: {
                    to: RECIPIENT,
                    amount: "1",
                    token: 42,
                    chainId: "0x1",
                },
                broadcastTime: Date.now(),
            },
        },
    ],
    [
        "error-tx",
        {
            amount: "1",
            symbol: "?",
            token: 42,
            to: RECIPIENT,
            hash: TX_HASH,
            message: "The transaction failed.",
            chainId: "0x1",
        },
    ],
 ])(
    "a popup reopened onto %s shows no line for a stored token that is not text",
    async (view, viewData) => {
        const page = await bootPopup(
            profile(false, [], {
                currentView: view,
                viewStack: ["main"],
                viewData,
            }),
        );
        expect(page.pageErrors).toEqual([]);
        expect(page.visibleViews()).toEqual([view]);
        expect(page.node(view + "-token-note").innerHTML).toBe("");
    },
 );
 test("SignApproval says so under a permit's token while Use Blockscout is off", async () => {
    const signParams = {
        method: "eth_signTypedData_v4",
        typedData: JSON.stringify(PERMIT),
        from: signer.address,
    };
    const page = await bootApproval(profile(false, []), { signParams });
    const message = page.node("approve-sign-message").innerHTML;
    expect(message).toContain("Unknown token");
    expect(message).toContain(LINE);
    cleanupPopup();
    const on = await bootApproval(profile(true, [TOKEN_ROW]), { signParams });
    const named = on.node("approve-sign-message").innerHTML;
    expect(named).toContain("5000.0000 NOVEL");
    expect(named).not.toContain(LINE);
 });
@@ -19,7 +19,10 @@
 //     that followed persisted the pre-refresh values — while still stamping
 //     lastBalanceRefresh, suppressing the redo.
 //
-// Both use the real persistence path over a cloning storage stub. Nothing here
+// A network switch landing inside a balance refresh's round trip is covered at
 // the end (https://git.eeqj.de/sneak/AutistMask/issues/577).
 //
 // All use the real persistence path over a cloning storage stub. Nothing here
 // asserts the absence of a loadState() call; each asserts the OUTCOME, so it
 // holds against any implementation that gets the outcome right.
@@ -139,6 +142,8 @@ function loadWorker(networkId, opts) {
        },
        refreshBalances:
            options.refreshBalances || jest.fn(async () => undefined),
        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
            .dropUntrackedTokens,
    }));
    jest.doMock("../src/shared/phishingDomains", () => ({
        isPhishingDomain: () => false,
@@ -395,3 +400,99 @@ describe("a balance refresh under another handler's state read", () => {
        expect(after.wallets[0].addresses[0].balance).toBe(REFRESHED_BALANCE);
    });
 });
 describe("a balance refresh under a network switch", () => {
    // https://git.eeqj.de/sneak/AutistMask/issues/577. The switch clears every
    // address's balances, and a refresh that started on the previous network
    // must not write that network's back over them when it returns. The same
    // refresh in the popup is in tests/balanceRefreshNetworkSwitch.test.js.
    test("a refresh that returns after a switch writes nothing, and the next one runs on the new network", async () => {
        const roundTrip = deferred();
        const reachedNetwork = deferred();
        const ranOn = [];
        const bg = loadWorker("sepolia", {
            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
                ranOn.push(id);
                reachedNetwork.resolve();
                await roundTrip.promise;
                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
            },
        });
        const refresh = bg.fireBalanceAlarm();
        await reachedNetwork.promise;
        // The user switches to Ethereum Mainnet in Settings while the round
        // trip is out.
        const during = bg.persisted();
        applyChainSwitchFields(during, MAINNET.id);
        global.chrome.storage.write("autistmask", during);
        roundTrip.resolve();
        await refresh;
        const after = bg.persisted();
        expect(after.networkId).toBe("mainnet");
        expect(after.wallets[0].addresses[0].balance).toBe("0");
        expect(after.lastBalanceRefresh).toBe(0);
        await bg.fireBalanceAlarm();
        expect(ranOn).toEqual(["sepolia", "mainnet"]);
        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
            REFRESHED_BALANCE,
        );
    });
 });
 describe("a balance refresh under a change of Use Blockscout", () => {
    // Turning "Use Blockscout" off drops the tokens the user has not tracked
    // (src/popup/views/settings.js). Blockscout may have answered a refresh
    // just before. That refresh still saves its balances when it returns, but
    // not those tokens. The same refresh in the popup is in
    // tests/blockscoutEtherscanSettings.test.js.
    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
        const roundTrip = deferred();
        const started = deferred();
        const bg = loadWorker("mainnet", {
            refreshBalances: async (wallets) => {
                started.resolve();
                await roundTrip.promise;
                wallets[0].addresses[0].balance = "7.0";
                wallets[0].addresses[0].tokenBalances = [
                    {
                        address: "0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
                        name: "Test Token",
                        symbol: "TST",
                        decimals: 18,
                        balance: "5.0",
                        holders: 50000,
                    },
                ];
            },
        });
        global.chrome.storage.write("autistmask", {
            ...bg.persisted(),
            useBlockscout: true,
        });
        const refresh = bg.fireBalanceAlarm();
        await started.promise;
        // The user unticks "Use Blockscout" in Settings while the round trip
        // is out.
        global.chrome.storage.write("autistmask", {
            ...bg.persisted(),
            useBlockscout: false,
        });
        roundTrip.resolve();
        await refresh;
        const after = bg.persisted();
        expect(after.wallets[0].addresses[0].balance).toBe("7.0");
        expect(after.wallets[0].addresses[0].tokenBalances).toEqual([]);
    });
 });
@@ -18,6 +18,17 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
 const TRACKED = {
    address: "0x7777777777777777777777777777777777777777",
    symbol: "TRK",
    decimals: 6,
 };
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
 globalThis.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
 };
 const realFetch = globalThis.fetch;
 let logged;
@@ -30,9 +41,9 @@ beforeEach(() => {
    const failedToFetch = async () => {
        throw new TypeError("Failed to fetch");
    };
-    // The RPC calls (ETH balance, ENS name, and the scan's balance and
+    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
-    // transaction count) and the explorer request (token balances) all fail
+    // the scan's balance and transaction count) and the explorer request (the
-    // the same way.
+    // other token balances) all fail the same way.
    FetchRequest.registerGetUrl(failedToFetch);
    globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -49,7 +60,7 @@ function refresh(signal) {
        wallets,
        RPC_URL,
        EXPLORER_URL,
-        [],
+        [TRACKED],
        "mainnet",
        signal,
    );
@@ -60,6 +71,7 @@ test("a failure while the popup is open is reported", async () => {
    for (const label of [
        "ETH balance failed",
        "ENS reverse failed",
        "token balance failed",
        "fetchTokenBalances failed: Failed to fetch",
    ]) {
        expect(logged.some((line) => line.includes(label))).toBe(true);
@@ -0,0 +1,161 @@
 // A balance refresh the popup started on one network, and that returns after
 // the network was switched to another, writes nothing: the switch cleared every
 // address's balances, and the previous network's must not come back over them
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). The switch is made either
 // by the user in this popup's Settings, or by the background after the user
 // approved a site's request, which changes only the stored record. Driven
 // through the real popup over a stored profile on Ethereum Mainnet. The same
 // refresh in the background is in tests/backgroundStateIsolation.test.js.
 const {
    bootPopup,
    cleanupPopup,
    unversionedValidProfile,
    TOKEN_ADDRESS,
 } = require("./support/popupBoot");
 const { applyChainSwitchFields } = require("../src/shared/chainSwitchFields");
 afterEach(() => {
    cleanupPopup();
 });
 // Starts the ten-second refresh and holds it open. The balance stand-in writes
 // Ethereum Mainnet's balances in place, on the records handed in, as the real
 // refreshBalances() does, once the returned function is called. Resolves with
 // that function and the refresh still running.
 async function holdRefresh(page) {
    const { refreshBalances } = require("../src/shared/balances");
    let answer;
    refreshBalances.mockImplementationOnce(async (wallets) => {
        await new Promise((resolve) => {
            answer = resolve;
        });
        wallets[0].addresses[0].balance = "7.0";
        wallets[0].addresses[0].tokenBalances = [
            {
                address: TOKEN_ADDRESS,
                name: "Test Token",
                symbol: "TST",
                decimals: 18,
                balance: "5.0",
                holders: null,
            },
        ];
    });
    const ticking = page.tick();
    await page.settle();
    return {
        finish: async () => {
            answer();
            await ticking;
        },
    };
 }
 // Picks `networkId` in the Settings network selector, as the user does.
 async function chooseNetwork(page, networkId) {
    const select = page.node("settings-network");
    select.value = networkId;
    for (const fn of select.listeners.change) await fn();
    await page.settle();
 }
 // The stored record holds none of Ethereum Mainnet's balances, and no refresh
 // recorded as done.
 function expectNothingStored(page) {
    const stored = page.storage.read("autistmask");
    expect(stored.networkId).toBe("sepolia");
    expect(stored.wallets[0].addresses[0].balance).toBe("0");
    expect(stored.wallets[0].addresses[0].tokenBalances).toEqual([]);
    expect(stored.lastBalanceRefresh).toBe(0);
 }
 test("a refresh that returns after a switch in Settings writes nothing, and the next one runs on the new network", async () => {
    const page = await bootPopup(unversionedValidProfile());
    expect(page.pageErrors).toEqual([]);
    const { refreshBalances } = require("../src/shared/balances");
    const { state } = require("../src/shared/state");
    const refresh = await holdRefresh(page);
    await page.click("btn-settings");
    await chooseNetwork(page, "sepolia");
    await refresh.finish();
    expect(state.wallets[0].addresses[0].balance).toBe("0");
    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
    expectNothingStored(page);
    await page.click("btn-settings-back");
    expect(page.visibleViews()).toEqual(["main"]);
    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
    await page.tick();
    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
    expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
        0,
    );
 });
 // The switch is made only once the refresh's save, holding the lock, has
 // written Ethereum Mainnet's balances, and the switch then clears them.
 test("a refresh whose save is reading the stored record when the user switches in Settings leaves none of its balances stored", async () => {
    const page = await bootPopup(unversionedValidProfile());
    expect(page.pageErrors).toEqual([]);
    const { state } = require("../src/shared/state");
    const refresh = await holdRefresh(page);
    await page.click("btn-settings");
    // The next read of the stored record, the refresh's save's, is held.
    const get = page.storage.local.get;
    const read = get.getMockImplementation();
    let releaseRead;
    get.mockImplementationOnce(async (key) => {
        await new Promise((resolve) => {
            releaseRead = resolve;
        });
        return read(key);
    });
    const finishing = refresh.finish();
    await page.settle();
    // The user picks Sepolia meanwhile; the switch's own save waits for the
    // refresh's save to let the lock go.
    const select = page.node("settings-network");
    select.value = "sepolia";
    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
    await page.settle();
    releaseRead();
    await finishing;
    await switching;
    await page.settle();
    expect(state.networkId).toBe("sepolia");
    expect(state.wallets[0].addresses[0].balance).toBe("0");
    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
    expectNothingStored(page);
 });
 test("a refresh that returns after the background switched the network writes nothing", async () => {
    const page = await bootPopup(unversionedValidProfile());
    expect(page.pageErrors).toEqual([]);
    const { saveState } = require("../src/shared/state");
    const refresh = await holdRefresh(page);
    // The background writes the switch to Sepolia, as its updateState() does
    // once the user approves a site's request. This page is not told of it
    // yet.
    const record = page.storage.read("autistmask");
    applyChainSwitchFields(record, "sepolia");
    page.storage.write("autistmask", record);
    await refresh.finish();
    expectNothingStored(page);
    // Nor does a later save by this page, such as every navigation makes.
    await saveState();
    expectNothingStored(page);
 });
@@ -0,0 +1,848 @@
 // Blockscout and Etherscan are sent none of the user's data until the user
 // turns on a setting for each
 // (https://git.eeqj.de/sneak/AutistMask/issues/668). A new profile has "Use
 // Blockscout" and "Check recipients on Etherscan" both off. While a setting is
 // off, no request sends its service the user's data.
 //
 // One request still reaches Blockscout while "Use Blockscout" is off: the check
 // behind "Save" beside the Blockscout URL in Settings. That check asks the URL
 // only for `/stats` and sends none of the user's data.
 //
 // Before any other request to Blockscout or Etherscan, the wallet reads that
 // service's setting from storage, not the page's copy. The wallet reads the
 // setting again when the answer lands. So a change saved by another page
 // applies at once. An open page also takes such a change and draws its screens
 // again.
 //
 // Only Blockscout reports the tokens the user has not tracked. While "Use
 // Blockscout" is off, no address keeps them and no screen lists them.
 //
 // The functions that make the requests are driven directly, against a fetch()
 // that records every URL it is asked for. The screens are driven through the
 // real popup over a stored profile (tests/support/popupBoot.js). The fetch()
 // stub in popupBoot.js records the same way.
 "use strict";
 const { FetchRequest } = require("ethers");
 const {
    bootPopup,
    cleanupPopup,
    unversionedValidProfile,
    ADDRESS,
    TOKEN_ADDRESS,
 } = require("./support/popupBoot");
 const { makeStorageStub } = require("./support/storageStub");
 const {
    DEFAULT_STATE,
    normalizePersisted,
 } = require("../src/shared/persistedState");
 const {
    fetchTokenBalances,
    refreshBalances,
 } = require("../src/shared/balances");
 const { fetchRecentTransactions } = require("../src/shared/transactions");
 const { getFullWarnings } = require("../src/shared/addressWarnings");
 const { checkEtherscanLabel } = require("../src/shared/etherscanLabels");
 const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
 const RPC_URL = "https://rpc.example.invalid";
 const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
 const RECIPIENT = "0x2222222222222222222222222222222222222222";
 const TX_HASH = "0x" + "ab".repeat(32);
 const ZERO_WORD = "0x" + "0".repeat(64);
 // USDC, from the bundled list, as Blockscout reports a holding of it.
 const USDC_ROW = {
    value: "5000000",
    token: {
        type: "ERC-20",
        address_hash: "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
        symbol: "USDC",
        name: "USD Coin",
        decimals: "6",
        holders_count: "50000",
    },
 };
 // A transfer of 1 ETH from RECIPIENT to ADDRESS, as Blockscout lists it in
 // ADDRESS's history.
 const HISTORY_ITEM = {
    hash: TX_HASH,
    block_number: 21000000,
    timestamp: "2026-02-27T12:00:00.000Z",
    from: { hash: RECIPIENT },
    to: { hash: ADDRESS, is_contract: false },
    value: "1000000000000000000",
    method: null,
    status: "ok",
 };
 // Etherscan's page for RECIPIENT, which labels it a phishing address.
 const PHISHING_PAGE =
    "<html><head><title>Fake_Phishing1 | Address: " +
    RECIPIENT +
    " | Etherscan</title></head><body></body></html>";
 const realFetch = globalThis.fetch;
 afterEach(() => {
    cleanupPopup();
    jest.restoreAllMocks();
 });
 describe("a new profile", () => {
    test("has both settings off", () => {
        expect(DEFAULT_STATE.useBlockscout).toBe(false);
        expect(DEFAULT_STATE.checkRecipientsOnEtherscan).toBe(false);
        const loaded = normalizePersisted(undefined);
        expect(loaded.useBlockscout).toBe(false);
        expect(loaded.checkRecipientsOnEtherscan).toBe(false);
    });
    test("keeps either setting the user turned on", () => {
        const loaded = normalizePersisted({
            useBlockscout: true,
            checkRecipientsOnEtherscan: true,
        });
        expect(loaded.useBlockscout).toBe(true);
        expect(loaded.checkRecipientsOnEtherscan).toBe(true);
    });
 });
 describe("where each request is made", () => {
    // Every URL that fetch() was asked for, in order.
    let asked;
    // What Blockscout and Etherscan answer: USDC among ADDRESS's tokens,
    // HISTORY_ITEM in its history, and PHISHING_PAGE for RECIPIENT.
    function answer(url) {
        return {
            ok: true,
            status: 200,
            json: async () => {
                if (url.endsWith("/token-balances")) return [USDC_ROW];
                if (url.endsWith("/transactions")) {
                    return { items: [HISTORY_ITEM] };
                }
                return { items: [] };
            },
            text: async () => PHISHING_PAGE,
        };
    }
    async function recordAndAnswer(url) {
        asked.push(String(url));
        return answer(String(url));
    }
    beforeEach(() => {
        asked = [];
        globalThis.fetch = jest.fn(recordAndAnswer);
    });
    afterEach(() => {
        globalThis.fetch = realFetch;
        delete globalThis.chrome;
    });
    // Storage holds `profile` as the stored profile, or nothing when it is
    // undefined.
    function storing(profile) {
        globalThis.chrome = {
            storage: makeStorageStub(
                profile === undefined ? {} : { autistmask: profile },
            ),
        };
    }
    test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
        storing({ useBlockscout: false });
        expect(await fetchTokenBalances(ADDRESS, BLOCKSCOUT, [])).toEqual([]);
        expect(asked).toEqual([]);
        storing({ useBlockscout: true });
        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, []);
        expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
        expect(asked).toEqual([
            BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
        ]);
    });
    test("the transaction history is asked for only while Use Blockscout is on", async () => {
        storing({ useBlockscout: false });
        expect(
            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
        ).toEqual([]);
        expect(asked).toEqual([]);
        storing({ useBlockscout: true });
        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1");
        expect(asked.sort()).toEqual([
            BLOCKSCOUT +
                "/addresses/" +
                ADDRESS +
                "/token-transfers?type=ERC-20",
            BLOCKSCOUT + "/addresses/" + ADDRESS + "/transactions",
        ]);
    });
    test("the Etherscan label check is made only while the stored profile has Check recipients on Etherscan on", async () => {
        const provider = {
            getCode: async () => "0x",
            getTransactionCount: async () => 1,
            getBalance: async () => 0n,
        };
        const checkWith = async (profile) => {
            storing(profile);
            await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
        };
        await checkWith(undefined);
        await checkWith({ checkRecipientsOnEtherscan: false });
        // Only a stored true is on, as when the profile is loaded.
        await checkWith({ checkRecipientsOnEtherscan: "true" });
        await checkWith({ checkRecipientsOnEtherscan: 42 });
        expect(asked).toEqual([]);
        await checkWith({ checkRecipientsOnEtherscan: true });
        expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
    });
    // Asks with `setting` on in storage. Once every request is out, storage
    // holds `after` for the setting, as when the user changes it here or on
    // another page. Only then does each request get its answer.
    async function answeredAfter(setting, after, ask) {
        storing({ [setting]: true });
        let release;
        const held = new Promise((resolve) => {
            release = resolve;
        });
        let requested;
        const out = new Promise((resolve) => {
            requested = resolve;
        });
        globalThis.fetch = jest.fn(async (url) => {
            requested();
            await held;
            return recordAndAnswer(url);
        });
        const result = ask();
        await out;
        globalThis.chrome.storage.write("autistmask", { [setting]: after });
        release();
        return result;
    }
    // One row per request, giving:
    //
    //   - its name
    //   - the setting that gates it
    //   - how to make it
    //   - its answer while that setting is off
    test.each([
        [
            "Blockscout's token balances",
            "useBlockscout",
            () => fetchTokenBalances(ADDRESS, BLOCKSCOUT, []),
            [],
        ],
        [
            "the transaction history",
            "useBlockscout",
            () => fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
            [],
        ],
        [
            "the Etherscan label check",
            "checkRecipientsOnEtherscan",
            () => checkEtherscanLabel(RECIPIENT, "0x1"),
            null,
        ],
    ])(
        "%s keeps an answer that lands while its setting is on, and drops one that lands after it went off",
        async (_what, setting, ask, dropped) => {
            expect(await answeredAfter(setting, true, ask)).not.toEqual(
                dropped,
            );
            expect(await answeredAfter(setting, false, ask)).toEqual(dropped);
        },
    );
    describe("a balance refresh", () => {
        // The RPC endpoint answers every balance with zero. The ENS reverse
        // lookup makes the only other calls, and it finds no resolver.
        beforeEach(() => {
            FetchRequest.registerGetUrl(async (req) => {
                const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
                const reply = (r) => ({
                    jsonrpc: "2.0",
                    id: r.id,
                    result: r.method === "eth_getBalance" ? "0x0" : ZERO_WORD,
                });
                const answer = Array.isArray(body)
                    ? body.map(reply)
                    : reply(body);
                return {
                    statusCode: 200,
                    statusMessage: "OK",
                    headers: { "content-type": "application/json" },
                    body: Buffer.from(JSON.stringify(answer)),
                };
            });
        });
        afterEach(() => {
            FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
        });
        // An address refreshed while "Use Blockscout" was on. It holds the USDC
        // that Blockscout reported then.
        function addressWithUsdc() {
            return {
                address: ADDRESS,
                tokenBalances: [
                    {
                        address: USDC_ROW.token.address_hash,
                        name: "USD Coin",
                        symbol: "USDC",
                        decimals: 6,
                        balance: "5.0",
                        holders: 50000,
                    },
                ],
            };
        }
        async function refresh(addr, useBlockscout) {
            storing({ useBlockscout });
            await refreshBalances(
                [{ addresses: [addr] }],
                RPC_URL,
                BLOCKSCOUT,
                [],
                "mainnet",
            );
        }
        test("asks Blockscout nothing while Use Blockscout is off, and then lists no token the user has not tracked", async () => {
            const addr = addressWithUsdc();
            await refresh(addr, false);
            expect(asked).toEqual([]);
            expect(addr.tokenBalances).toEqual([]);
        });
        test("asks Blockscout for the token balances while Use Blockscout is on", async () => {
            const addr = addressWithUsdc();
            await refresh(addr, true);
            expect(asked).toEqual([
                BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
            ]);
            expect(addr.tokenBalances.map((row) => row.symbol)).toEqual([
                "USDC",
            ]);
        });
    });
 });
 describe("the popup", () => {
    // Every URL the booted page handed to fetch().
    function fetched() {
        return globalThis.fetch.mock.calls.map((call) => String(call[0]));
    }
    function blockscoutOrEtherscan(url) {
        return url.includes("blockscout") || url.includes("etherscan");
    }
    beforeEach(() => {
        // The screens below log their failed RPC reads; the stub node in
        // popupBoot.js answers none.
        jest.spyOn(console, "error").mockImplementation(() => {});
    });
    test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
        const page = await bootPopup(unversionedValidProfile());
        expect(page.node("home-tx-list").innerHTML).toContain(
            escapeHtml(HISTORY_OFF_TEXT),
        );
        expect(page.hidden("home-tokens-note")).toBe(false);
        cleanupPopup();
        const on = await bootPopup(
            unversionedValidProfile({ useBlockscout: true }),
        );
        expect(on.node("home-tx-list").innerHTML).toContain(
            "No transactions found.",
        );
        expect(on.hidden("home-tokens-note")).toBe(true);
    });
    // The transaction screen, as a reopened popup draws it.
    function onTransactionScreen(extra) {
        return unversionedValidProfile({
            currentView: "transaction",
            viewStack: ["main"],
            selectedWallet: 0,
            selectedAddress: 0,
            viewData: {
                tx: {
                    hash: TX_HASH,
                    from: ADDRESS,
                    to: RECIPIENT,
                    value: "1.0000",
                    exactValue: "1.0",
                    symbol: "ETH",
                    timestamp: 1790000000,
                    isError: false,
                    direction: "sent",
                    directionLabel: "Sent",
                    contractAddress: null,
                    chainId: "0x1",
                },
            },
            ...extra,
        });
    }
    test("TransactionDetail asks Blockscout for the transaction only while Use Blockscout is on", async () => {
        const page = await bootPopup(onTransactionScreen());
        expect(page.visibleViews()).toEqual(["transaction"]);
        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
        cleanupPopup();
        const on = await bootPopup(
            onTransactionScreen({ useBlockscout: true }),
        );
        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
            BLOCKSCOUT + "/transactions/" + TX_HASH,
        ]);
        expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
    });
    // Another page turns "Use Blockscout" off while TransactionDetail's request
    // to Blockscout is out. This page draws TransactionDetail again with its
    // line, and only then does Blockscout answer.
    test("TransactionDetail shows nothing from an answer that lands after another page turned Use Blockscout off", async () => {
        const page = await bootPopup(
            onTransactionScreen({ useBlockscout: true }),
        );
        let release;
        const held = new Promise((resolve) => {
            release = resolve;
        });
        globalThis.fetch = jest.fn(async () => {
            await held;
            return {
                ok: true,
                status: 200,
                json: async () => ({
                    block_number: 21000000,
                    fee: { value: "21000000000000" },
                    raw_input: "0x12345678",
                    method: "doSomething",
                }),
            };
        });
        require("../src/popup/views/transactionDetail").render();
        await page.settle();
        expect(fetched()).toEqual([BLOCKSCOUT + "/transactions/" + TX_HASH]);
        await anotherPageAnnounces(page, { useBlockscout: false });
        release();
        await page.settle();
        expect(page.visibleViews()).toEqual(["transaction"]);
        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
        for (const id of [
            "tx-detail-block-section",
            "tx-detail-network-section",
            "tx-detail-calldata-section",
            "tx-detail-rawdata-section",
        ]) {
            expect(page.hidden(id)).toBe(true);
        }
        expect(fetched()).toHaveLength(1);
    });
    // The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
    // reopened popup draws it.
    function onConfirmScreen(extra) {
        return unversionedValidProfile({
            currentView: "confirm-tx",
            viewStack: ["main"],
            selectedWallet: 0,
            selectedAddress: 0,
            viewData: {
                pendingTx: {
                    token: "ETH",
                    from: ADDRESS,
                    to: RECIPIENT,
                    amount: "0.1",
                    chainId: "0x1",
                },
            },
            ...extra,
        });
    }
    test("ConfirmTx asks Etherscan about the recipient only while Check recipients on Etherscan is on", async () => {
        const page = await bootPopup(onConfirmScreen());
        expect(page.visibleViews()).toEqual(["confirm-tx"]);
        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
        expect(page.hidden("confirm-etherscan-note")).toBe(false);
        expect(page.hidden("confirm-etherscan-warning")).toBe(true);
        cleanupPopup();
        const on = await bootPopup(
            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
        );
        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
            "https://etherscan.io/address/" + RECIPIENT,
        ]);
        expect(on.hidden("confirm-etherscan-note")).toBe(true);
        expect(on.hidden("confirm-etherscan-warning")).toBe(false);
    });
    // Ticks or unticks a checkbox on the page, as the user does.
    async function setBox(page, id, checked) {
        const box = page.node(id);
        box.checked = checked;
        for (const fn of box.listeners.change) await fn();
        await page.settle();
    }
    test("Welcome offers both settings unticked, and ticking one there stores it", async () => {
        const page = await bootPopup(undefined);
        expect(page.visibleViews()).toEqual(["welcome"]);
        expect(page.node("welcome-use-blockscout").checked).toBe(false);
        expect(page.node("welcome-check-recipients-on-etherscan").checked).toBe(
            false,
        );
        await setBox(page, "welcome-use-blockscout", true);
        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
        await setBox(page, "welcome-check-recipients-on-etherscan", true);
        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
            true,
        );
    });
    test("Settings shows both settings unticked, and ticking one there stores it", async () => {
        const page = await bootPopup(unversionedValidProfile());
        await page.click("btn-settings");
        expect(page.node("settings-use-blockscout").checked).toBe(false);
        expect(
            page.node("settings-check-recipients-on-etherscan").checked,
        ).toBe(false);
        await setBox(page, "settings-use-blockscout", true);
        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
        await setBox(page, "settings-check-recipients-on-etherscan", true);
        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
            true,
        );
    });
    // A token the user tracks, and an untracked one that Blockscout reported.
    // Both are written in lower case, because the balance rows' and the
    // dropdown's token ids are compared in lower case below.
    const TRACKED = "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
    const UNTRACKED = TOKEN_ADDRESS.toLowerCase();
    const SECOND_ADDRESS = "0x3333333333333333333333333333333333333333";
    function tokenRow(address, symbol) {
        return {
            address,
            name: symbol,
            symbol,
            decimals: 18,
            balance: "5.0",
            holders: 50000,
        };
    }
    // AddressDetail of the first of two addresses, as a reopened popup draws
    // it. Both addresses hold the tracked token. While "Use Blockscout" is on,
    // both hold the untracked one too.
    function onAddressDetail(useBlockscout) {
        const profile = unversionedValidProfile({
            useBlockscout,
            currentView: "address",
            viewStack: ["main"],
            selectedWallet: 0,
            selectedAddress: 0,
            trackedTokens: [
                { address: TRACKED, name: "TRK", symbol: "TRK", decimals: 18 },
            ],
        });
        const wallet = profile.wallets[0];
        wallet.nextIndex = 2;
        wallet.addresses.push({ address: SECOND_ADDRESS, balance: "0.0" });
        for (const addr of wallet.addresses) {
            addr.tokenBalances = useBlockscout
                ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
                : [tokenRow(TRACKED, "TRK")];
        }
        return profile;
    }
    // The token ids of the options created after the first `from` elements.
    // The page stub keeps no children, so this reads the options for Send's
    // dropdown from the elements the page created.
    function optionsSince(page, from) {
        return page.document.created
            .slice(from)
            .filter((el) => el.tagName === "OPTION")
            .map((el) => el.value.toLowerCase());
    }
    test("unticking Use Blockscout from AddressDetail's gear takes the untracked token off AddressDetail, Send's dropdown and Home on Back", async () => {
        const page = await bootPopup(onAddressDetail(true));
        expect(page.visibleViews()).toEqual(["address"]);
        expect(page.node("address-balances").innerHTML).toContain(UNTRACKED);
        await page.click("btn-settings");
        await setBox(page, "settings-use-blockscout", false);
        const from = page.document.created.length;
        await page.click("btn-settings-back");
        expect(page.visibleViews()).toEqual(["address"]);
        const balances = page.node("address-balances").innerHTML;
        expect(balances).toContain(TRACKED);
        expect(balances).not.toContain(UNTRACKED);
        expect(page.hidden("address-tokens-note")).toBe(false);
        expect(optionsSince(page, from)).toEqual([TRACKED]);
        await page.click("btn-send");
        expect(page.visibleViews()).toEqual(["send"]);
        expect(page.hidden("send-token-dropdown")).toBe(false);
        expect(page.hidden("send-tokens-note")).toBe(false);
        await page.click("btn-send-back");
        await page.click("btn-address-back");
        expect(page.visibleViews()).toEqual(["main"]);
        const home = page.node("wallet-list").innerHTML;
        expect(home).toContain(TRACKED);
        expect(home).not.toContain(UNTRACKED);
        const stored = page.storage.read("autistmask");
        for (const addr of stored.wallets[0].addresses) {
            expect(
                addr.tokenBalances.map((row) => row.address.toLowerCase()),
            ).toEqual([TRACKED]);
        }
    });
    // Send's dropdown was filled under the old setting, and Back cannot draw
    // Send again. So Back lands on the screen under it.
    test.each([
        ["unticking", true],
        ["ticking", false],
    ])(
        "%s Use Blockscout from Send's gear lands Back on AddressDetail",
        async (_how, before) => {
            const page = await bootPopup(onAddressDetail(before));
            await page.click("btn-send");
            expect(page.visibleViews()).toEqual(["send"]);
            await page.click("btn-settings");
            await setBox(page, "settings-use-blockscout", !before);
            await page.click("btn-settings-back");
            expect(page.visibleViews()).toEqual(["address"]);
            expect(page.hidden("address-tokens-note")).toBe(!before);
        },
    );
    test("Send says under its token dropdown that only tracked tokens are listed while Use Blockscout is off", async () => {
        const off = await bootPopup(onAddressDetail(false));
        await off.click("btn-send");
        expect(off.hidden("send-token-dropdown")).toBe(false);
        expect(off.hidden("send-tokens-note")).toBe(false);
        cleanupPopup();
        const on = await bootPopup(onAddressDetail(true));
        await on.click("btn-send");
        expect(on.hidden("send-token-dropdown")).toBe(false);
        expect(on.hidden("send-tokens-note")).toBe(true);
    });
    test("Send opened from AddressToken shows neither the dropdown nor its line", async () => {
        const page = await bootPopup({
            ...onAddressDetail(false),
            currentView: "address-token",
            viewStack: ["main", "address"],
            selectedToken: "ETH",
        });
        expect(page.visibleViews()).toEqual(["address-token"]);
        await page.click("btn-address-token-send");
        expect(page.visibleViews()).toEqual(["send"]);
        expect(page.hidden("send-token-dropdown")).toBe(true);
        expect(page.hidden("send-token-static")).toBe(false);
    });
    test("DeleteAddress says only tracked tokens are listed while Use Blockscout is off", async () => {
        for (const useBlockscout of [false, true]) {
            const page = await bootPopup(onAddressDetail(useBlockscout));
            require("../src/popup/views/deleteAddress").show(0, 1);
            expect(page.visibleViews()).toEqual(["delete-address-confirm"]);
            expect(page.hidden("delete-address-tokens-note")).toBe(
                useBlockscout,
            );
            cleanupPopup();
        }
    });
    // The token ids of the first address's balances in the stored profile.
    function storedTokens(page) {
        return page.storage
            .read("autistmask")
            .wallets[0].addresses[0].tokenBalances.map((row) =>
                row.address.toLowerCase(),
            );
    }
    // Turning the setting off dropped the untracked token. A refresh that
    // started while the setting was on still saves its balances when it
    // returns, but not that token. The same refresh in the background is in
    // tests/backgroundStateIsolation.test.js.
    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
        const page = await bootPopup(onAddressDetail(true));
        const { refreshBalances: held } = require("../src/shared/balances");
        let answer;
        held.mockImplementationOnce(async (wallets) => {
            await new Promise((resolve) => {
                answer = resolve;
            });
            wallets[0].addresses[0].balance = "7.0";
            wallets[0].addresses[0].tokenBalances = [
                tokenRow(TRACKED, "TRK"),
                tokenRow(UNTRACKED, "TST"),
            ];
        });
        const ticking = page.tick();
        await page.settle();
        await page.click("btn-settings");
        await setBox(page, "settings-use-blockscout", false);
        answer();
        await ticking;
        expect(
            page.storage.read("autistmask").wallets[0].addresses[0].balance,
        ).toBe("7.0");
        expect(storedTokens(page)).toEqual([TRACKED]);
        await page.click("btn-settings-back");
        expect(page.node("address-balances").innerHTML).not.toContain(
            UNTRACKED,
        );
    });
    // Another page saves `change` over the stored profile. The browser is not
    // made to tell this page, so this page sees the change only by reading the
    // stored profile.
    function anotherPageSaves(page, change) {
        page.storage.write("autistmask", {
            ...page.storage.read("autistmask"),
            ...change,
        });
    }
    test.each([
        ["off", true, false],
        ["on", false, true],
    ])(
        "after another page turns Use Blockscout %s, this page takes the change and its next refresh is saved",
        async (_how, before, after) => {
            const page = await bootPopup(onAddressDetail(before));
            // The refresh answers as it does under the stored setting.
            const { refreshBalances: held } = require("../src/shared/balances");
            held.mockImplementationOnce(async (wallets) => {
                const addr = wallets[0].addresses[0];
                addr.balance = "7.0";
                addr.tokenBalances = after
                    ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
                    : [tokenRow(TRACKED, "TRK")];
            });
            anotherPageSaves(page, { useBlockscout: after });
            await page.tick();
            expect(
                page.storage.read("autistmask").wallets[0].addresses[0].balance,
            ).toBe("7.0");
            expect(storedTokens(page)).toEqual(
                after ? [TRACKED, UNTRACKED] : [TRACKED],
            );
            expect(page.hidden("address-tokens-note")).toBe(after);
        },
    );
    test.each([
        ["off", true, false],
        ["on", false, true],
    ])(
        "after another page turns Check recipients on Etherscan %s, this page's next Etherscan check follows the stored setting",
        async (_how, before, after) => {
            const page = await bootPopup(
                onConfirmScreen({ checkRecipientsOnEtherscan: before }),
            );
            anotherPageSaves(page, { checkRecipientsOnEtherscan: after });
            const from = fetched().length;
            require("../src/popup/views/confirmTx").show({
                token: "ETH",
                from: ADDRESS,
                to: RECIPIENT,
                amount: "0.1",
                chainId: "0x1",
            });
            await page.settle();
            // The page also takes the change and draws ConfirmTx again, which
            // checks once more. So the test counts each URL once, however often
            // it was asked for.
            const asked = new Set(
                fetched().slice(from).filter(blockscoutOrEtherscan),
            );
            expect([...asked]).toEqual(
                after ? ["https://etherscan.io/address/" + RECIPIENT] : [],
            );
        },
    );
    // Another page's save of the whole profile with `change`, which the
    // browser announces to this page as it announces any write.
    async function anotherPageAnnounces(page, change) {
        await page.storage.local.set({
            autistmask: { ...page.storage.read("autistmask"), ...change },
        });
        await page.settle();
    }
    test("a page open on AddressDetail draws it again when another page turns Use Blockscout off", async () => {
        const page = await bootPopup(onAddressDetail(true));
        expect(page.hidden("address-tokens-note")).toBe(true);
        await anotherPageAnnounces(page, { useBlockscout: false });
        expect(page.visibleViews()).toEqual(["address"]);
        expect(page.hidden("address-tokens-note")).toBe(false);
        expect(page.node("address-balances").innerHTML).not.toContain(
            UNTRACKED,
        );
        expect(storedTokens(page)).toEqual([TRACKED]);
    });
    test("a page open on ConfirmTx draws it again when another page turns Check recipients on Etherscan off", async () => {
        const page = await bootPopup(
            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
        );
        expect(page.hidden("confirm-etherscan-note")).toBe(true);
        await anotherPageAnnounces(page, { checkRecipientsOnEtherscan: false });
        expect(page.visibleViews()).toEqual(["confirm-tx"]);
        expect(page.hidden("confirm-etherscan-note")).toBe(false);
    });
 });
@@ -446,7 +446,10 @@ describe("switching the network in Settings tells every open tab", () => {
        global.chrome.runtime.sendMessage = (msg) => {
            bg.send(msg, POPUP);
        };
-        await require("../src/shared/state").loadState();
+        const { state, loadState } = require("../src/shared/state");
        await loadState();
        // Set by showView(), which is mocked above.
        state.currentView = "settings";
        require("../src/popup/views/settings").init({
            pageClosed: new AbortController().signal,
        });
@@ -73,6 +73,8 @@ function loadColdWorker(networkId, opts) {
    jest.doMock("../src/shared/balances", () => ({
        getProvider: () => ({}),
        refreshBalances: options.refreshBalances || jest.fn(async () => {}),
        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
            .dropUntrackedTokens,
    }));
    jest.doMock("../src/shared/phishingDomains", () => ({
        isPhishingDomain: () => false,
@@ -108,7 +108,10 @@ global.fetch = jest.fn(() => {
 });
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
    runtime: { sendMessage() {} },
 };
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -158,7 +161,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const {
    Interface,
@@ -243,6 +246,10 @@ async function openSend(token, tokenUnits = null) {
    ];
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    // Blockscout is asked only while the stored "Use Blockscout" is on. The
    // screens save this page's copy of "Use Blockscout" over the stored one. So
    // the page's copy is turned on here too.
    state.useBlockscout = true;
    await refreshBalances(
        state.wallets,
        "https://rpc.example.invalid",
@@ -50,8 +50,14 @@ function explorerPage(title) {
 // The explorer labels no address.
 global.fetch = jest.fn(async () => explorerPage("Etherscan"));
 // The Etherscan label check is made, so its box can be shown.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
    storage: makeStorageStub({
        autistmask: { checkRecipientsOnEtherscan: true },
    }),
    runtime: { sendMessage() {} },
 };
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -142,13 +142,19 @@ jest.mock("../src/popup/views/txStatus", () => ({
 }));
 // The Etherscan label check is its only caller here: the explorer pages it
-// asks for are recorded, and nothing is fetched.
+// asks for are recorded, and nothing is fetched. The stored profile has the
 // check turned on.
 global.fetch = jest.fn(() => {
    throw new Error("tests must not perform network requests");
 });
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
    storage: makeStorageStub({
        autistmask: { checkRecipientsOnEtherscan: true },
    }),
    runtime: { sendMessage() {} },
 };
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -189,7 +195,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const {
    BaseWallet,
@@ -297,6 +297,8 @@ describe.each([
        state.selectedWallet = 0;
        state.selectedAddress = 0;
        state.selectedToken = "ETH";
        // The history is Blockscout's.
        state.useBlockscout = true;
    });
    test("a contract creation's row says so, with no colour dot and no address line", async () => {
@@ -101,7 +101,7 @@ describe("the flash line the message is shown in", () => {
    //
    // The line cuts a message too long for it with an ellipsis (see
    // showFlash() in src/popup/views/helpers.js). The assertions that
-    // measure that, in a real browser at the documented 360x600 popup, are
+    // measure that, in a real browser at the documented 396x600 popup, are
    // "a rejected dust threshold shifts no layout (#233)" and "an over-long
    // flash message keeps to one line (#252)" in tests/e2e/run.js, run by
    // make test-e2e. They are not in make check because REPO_POLICIES.md
@@ -867,6 +867,14 @@ step(
            "the page was not told of the approved switch: " +
                JSON.stringify(events),
        );
        // The popup, open all along, shows the new network
        // (https://git.eeqj.de/sneak/AutistMask/issues/650).
        await d.switchToWindow(env.popupWindow);
        await d.waitFor(
            "the open popup to show the testnet banner",
            `const banner = document.getElementById("debug-banner");
             return banner !== null && banner.textContent === "[TESTNET]";`,
        );
        await openNetworkPrompt(env, "switch-restore", sepolia, mainnet);
        await d.click("#btn-approve-network");
@@ -881,6 +889,10 @@ step(
            isDeepStrictEqual(await storedNetwork(env), before),
            "switching back did not restore the mainnet network and endpoints",
        );
        await d.waitFor(
            "the open popup to drop the testnet banner",
            `return document.getElementById("debug-banner") === null;`,
        );
        await d.switchToWindow(env.dappWindow);
    },
 );
@@ -653,6 +653,12 @@ function traceEnabled(raw) {
 *   confirmed receipt instead of null, so a wait screen resolves.
 * @param {boolean} [opts.failReceiptLookup]  answer eth_getTransactionReceipt
 *   with an error, so every receipt lookup fails; read at request time.
 * @param {string} [opts.etherscanLabel]  the label Etherscan's page gives the
 *   address asked about, such as "Fake_Phishing1"; none when unset. Read at
 *   request time.
 * @param {object[]} [opts.requests]  a list for the requests this handler
 *   sees. Each is appended in order as { method, url, fromWorker }, whether it
 *   came from a popup page or the background worker.
 * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
 *   Promise<string|null>}>}
 */
@@ -691,6 +697,13 @@ async function installNetworkStubs(ctx, opts) {
            const origin = fromWorker ? "[sw] " : "[page] ";
            console.log("# routed " + origin + req.method() + " " + req.url());
        }
        if (Array.isArray(opts.requests)) {
            opts.requests.push({
                method: req.method(),
                url: req.url(),
                fromWorker,
            });
        }
        // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
        if (req.method() === "POST") {
@@ -762,12 +775,20 @@ async function installNetworkStubs(ctx, opts) {
            return route.fulfill({ status: 204, body: "" });
        }
-        // Best-effort Etherscan address labels: served as an empty page.
+        // Best-effort Etherscan address labels: served as an empty page, or
        // as a page labelling the address with opts.etherscanLabel.
        if (url.hostname.endsWith("etherscan.io")) {
            const title = opts.etherscanLabel
                ? "<title>" +
                  opts.etherscanLabel +
                  " | Address: " +
                  p.split("/").pop() +
                  " | Etherscan</title>"
                : "";
            return route.fulfill({
                status: 200,
                contentType: "text/html",
-                body: "<html><body></body></html>",
+                body: "<html><head>" + title + "</head><body></body></html>",
            });
        }
@@ -60,6 +60,14 @@ const TEST_TIMEOUT_MS = 120000;
 // trailing drain in main().
 const TRAILING_WATCH_MS = 1500;
 // The popup's size, as README gives it: `body` in src/popup/styles/main.css
 // is 396px wide, and src/background/index.js opens an approval window at
 // the same 396x600. Pages in this context otherwise get Playwright's
 // 1280x720 default, where the page never scrolls sideways and a button
 // below the popup's fold is still on screen, so a layout measured there
 // passes whatever the page does.
 const POPUP_VIEWPORT = { width: 396, height: 600 };
 const tests = [];
 function test(name, fn) {
@@ -261,6 +269,69 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
    }
 });
 // ------------------ Blockscout and Etherscan are sent no user data (#668)
 //
 // A fresh install sends Blockscout and Etherscan none of the user's data until
 // the user turns on "Use Blockscout" or "Check recipients on Etherscan". One
 // request still reaches Blockscout while "Use Blockscout" is off: pressing
 // "Save" beside the Blockscout URL asks that URL for `/stats`. That request
 // carries no user data.
 //
 // The route handler in tests/e2e/network.js records in env.routeOpts.requests
 // every request the extension makes, from its pages and its background worker.
 // Recording starts when launch() in tests/e2e/harness.js installs that handler,
 // before the first popup page opens. The background worker starts earlier, but
 // it makes no request while it starts up.
 //
 // Before either setting is changed, these tests drive:
 //
 //   - Home, AddressDetail, AddressToken and ConfirmTx
 //   - the background's own balance refresh
 //
 // Then they turn each setting on and watch its requests start. "Use Blockscout"
 // is also turned off once and on again, to see an untracked token leave every
 // list. TransactionDetail, which also asks Blockscout, is left to the unit
 // tests in tests/blockscoutEtherscanSettings.test.js.
 // The line shown in place of the three transaction histories while "Use
 // Blockscout" is off. Written out here rather than imported, so the assertion
 // does not compare the popup with itself.
 const HISTORY_OFF =
    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
 // The requests made so far to Blockscout or Etherscan.
 function explorerRequests(env) {
    return env.routeOpts.requests.filter(({ url }) => {
        const host = new URL(url).hostname;
        return host.endsWith("blockscout.com") || host.endsWith("etherscan.io");
    });
 }
 // Waits until the list `listId` shows the line saying "Use Blockscout" is off.
 async function waitForHistoryOff(page, listId) {
    await page.waitForFunction(
        ([id, want]) => document.getElementById(id).textContent.trim() === want,
        [listId, HISTORY_OFF],
        { timeout: 15000 },
    );
 }
 test("Welcome offers Use Blockscout and Check recipients on Etherscan, both unticked (#668)", async (env) => {
    await visible(env.page, "#view-welcome");
    for (const id of [
        "welcome-use-blockscout",
        "welcome-check-recipients-on-etherscan",
    ]) {
        const st = await controlState(env.page, id);
        assert(st !== null, "Welcome has no #" + id);
        assert(
            st.tag === "input" && st.type === "checkbox",
            "#" + id + " is a <" + st.tag + " type=" + st.type + ">",
        );
        assert(st.checked === false, "#" + id + " is ticked on a new install");
    }
 });
 // The address scan that follows creating the wallet is held, so the popup
 // reloads while it is in flight. As for the reloads mid-refresh further down,
 // the assertion for that is the harness's own: a console.error from the page
@@ -288,6 +359,261 @@ test("wallet creation through the UI reaches the main view, and reloading mid-sc
    assert(addrCount > 0, "no addresses rendered in the wallet list");
 });
 test("with neither setting changed, Home, AddressDetail, AddressToken and ConfirmTx say what is off (#668)", async (env) => {
    // Funded, so Send leads to the confirmation screen.
    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
    try {
        await visible(env.page, "#view-main");
        await waitForHistoryOff(env.page, "home-tx-list");
        await visible(env.page, "#home-tokens-note");
        await env.page.waitForFunction(
            (want) =>
                document
                    .getElementById("wallet-list")
                    .textContent.includes(want),
            quantity(FUNDED_ETH_WEI),
            { timeout: 60000 },
        );
        await openAddressDetail(env.page);
        await waitForHistoryOff(env.page, "tx-list");
        await visible(env.page, "#address-tokens-note");
        await env.page.locator('#address-balances [data-token="ETH"]').click();
        await visible(env.page, "#view-address-token");
        await waitForHistoryOff(env.page, "address-token-tx-list");
        await env.page.click("#btn-address-token-back");
        await visible(env.page, "#view-address");
        await goToConfirm(env.page, {
            token: "ETH",
            balance: FUNDED_ETH_TEXT + " ETH",
            amount: COMFORTABLE_AMOUNT,
        });
        await waitForEstimate(env.page);
        await visible(env.page, "#confirm-etherscan-note");
        assert(
            !(await env.page.isVisible("#confirm-etherscan-warning")),
            "ConfirmTx keeps the Etherscan warning's place while no Etherscan check is made",
        );
        await backToAddress(env.page);
    } finally {
        env.routeOpts.ethBalanceWei = null;
    }
 });
 // The background refreshes balances on its alarm, once a minute. It skips a
 // refresh when the stored record says one ran in the last 30 seconds. The open
 // popup's own refresh runs every 10. So the popup is closed first. The test then
 // has the background worker set the stored time of the last refresh to 0, so
 // its next alarm runs a refresh.
 test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
    await waitForPersisted(
        env.page,
        "currentView",
        "address",
        "before the popup is closed",
    );
    await env.page.close();
    const [worker] = env.ctx.serviceWorkers();
    await worker.evaluate(
        () =>
            new Promise((resolve) => {
                chrome.storage.local.get("autistmask", (r) => {
                    const record = r.autistmask;
                    record.lastBalanceRefresh = 0;
                    chrome.storage.local.set({ autistmask: record }, resolve);
                });
            }),
    );
    const before = env.routeOpts.requests.length;
    const deadline = Date.now() + 75000;
    while (
        !env.routeOpts.requests
            .slice(before)
            .some((r) => r.fromWorker && r.method === "POST")
    ) {
        assert(
            Date.now() < deadline,
            "the background's balance refresh never asked the RPC endpoint",
        );
        await sleep(250);
    }
    // The refresh's RPC reads and any Blockscout request start together.
    await sleep(3000);
    const seen = explorerRequests(env);
    assert(
        seen.length === 0,
        "a fresh install asked Blockscout or Etherscan: " +
            JSON.stringify(seen),
    );
    // The watch saw the popup's own traffic as well as the worker's.
    assert(
        env.routeOpts.requests.some((r) => !r.fromWorker),
        "no request from the popup was recorded",
    );
    // The popup reopens on the address screen the test above left it on.
    env.page = await openPopup(env.ctx, env.popupUrl);
    await visible(env.page, "#view-address");
 });
 // Ticked from AddressDetail's gear, so Back lands on the screen that said the
 // setting is off.
 test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for that screen's history on Back, then for the tokens (#668)", async (env) => {
    await openAddressDetail(env.page);
    await waitForHistoryOff(env.page, "tx-list");
    await openSettings(env.page);
    await env.page.check("#settings-use-blockscout");
    await waitForPersisted(env.page, "useBlockscout", true, "once ticked");
    const historyAsked = env.page.waitForRequest(
        (r) =>
            r.url().includes("blockscout.com") &&
            r.url().endsWith("/transactions"),
    );
    const tokensAsked = env.page.waitForRequest(
        (r) => r.url().endsWith("/token-balances"),
        { timeout: 30000 },
    );
    await env.page.click("#btn-settings-back");
    await visible(env.page, "#view-address");
    await historyAsked;
    await env.page.waitForFunction(
        () =>
            document
                .getElementById("tx-list")
                .textContent.includes("No transactions found."),
        null,
        { timeout: 15000 },
    );
    assert(
        !(await env.page.isVisible("#address-tokens-note")),
        "AddressDetail still says only tracked tokens are listed",
    );
    await goHome(env.page);
    await tokensAsked;
    await env.page.waitForFunction(
        () =>
            document
                .getElementById("home-tx-list")
                .textContent.includes("No transactions found."),
        null,
        { timeout: 15000 },
    );
    assert(
        !(await env.page.isVisible("#home-tokens-note")),
        "Home still says only tracked tokens are listed",
    );
 });
 // Unticked from AddressDetail's gear while the address holds the stub token,
 // which the user has not tracked and only Blockscout reports. Ticked again at
 // the end, so the rest of the run has Blockscout as before.
 test("turning off Use Blockscout from AddressDetail's gear takes an untracked token off AddressDetail, Send and Home on Back (#668)", async (env) => {
    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
    env.routeOpts.seedTokenBalance = true;
    const tokenRow = '[data-token="' + STUB_TOKEN.address + '"]';
    try {
        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI, expectToken: true });
        await openAddressDetail(env.page);
        await visible(env.page, "#address-balances " + tokenRow);
        await openSettings(env.page);
        await env.page.uncheck("#settings-use-blockscout");
        await waitForPersisted(
            env.page,
            "useBlockscout",
            false,
            "once unticked",
        );
        await env.page.click("#btn-settings-back");
        await visible(env.page, "#view-address");
        await visible(env.page, "#address-tokens-note");
        assert(
            (await env.page
                .locator("#address-balances " + tokenRow)
                .count()) === 0,
            "AddressDetail still lists the untracked token",
        );
        await env.page.click("#btn-send");
        await visible(env.page, "#view-send");
        await visible(env.page, "#send-tokens-note");
        const offered = await env.page.$$eval("#send-token option", (opts) =>
            opts.map((opt) => opt.value.toLowerCase()),
        );
        assert(
            !offered.includes(STUB_TOKEN.address),
            "Send's dropdown still offers the untracked token",
        );
        await env.page.click("#btn-send-back");
        await visible(env.page, "#view-address");
        await goHome(env.page);
        await visible(env.page, "#home-tokens-note");
        assert(
            (await env.page.locator("#wallet-list " + tokenRow).count()) === 0,
            "Home still lists the untracked token",
        );
    } finally {
        await openSettings(env.page);
        await env.page.check("#settings-use-blockscout");
        await waitForPersisted(env.page, "useBlockscout", true, "ticked again");
        await env.page.click("#btn-settings-back");
        env.routeOpts.ethBalanceWei = null;
        env.routeOpts.seedTokenBalance = false;
    }
 });
 // Ticked from ConfirmTx's gear, so Back lands on the screen that said no
 // Etherscan check was made. Left on for the rest of the run, so the later
 // confirmation screens are driven with the check made.
 test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
    env.routeOpts.etherscanLabel = "Fake_Phishing668";
    try {
        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI });
        await goToConfirm(env.page, {
            token: "ETH",
            balance: FUNDED_ETH_TEXT + " ETH",
            amount: COMFORTABLE_AMOUNT,
        });
        await visible(env.page, "#confirm-etherscan-note");
        await openSettings(env.page);
        await env.page.check("#settings-check-recipients-on-etherscan");
        await waitForPersisted(
            env.page,
            "checkRecipientsOnEtherscan",
            true,
            "once ticked",
        );
        const before = env.routeOpts.requests.length;
        await env.page.click("#btn-settings-back");
        await visible(env.page, "#view-confirm-tx");
        await visible(env.page, "#confirm-etherscan-warning", 30000);
        assert(
            !(await env.page.isVisible("#confirm-etherscan-note")),
            "ConfirmTx says no Etherscan check was made, with the check on",
        );
        const asked = env.routeOpts.requests
            .slice(before)
            .map((r) => r.url.toLowerCase())
            .filter((url) => url.includes("etherscan.io"));
        assert(
            asked.length === 1 &&
                asked[0] ===
                    "https://etherscan.io/address/" + STUB_COUNTERPARTY,
            "ConfirmTx asked Etherscan for " + JSON.stringify(asked),
        );
        await backToAddress(env.page);
    } finally {
        env.routeOpts.ethBalanceWei = null;
        env.routeOpts.etherscanLabel = null;
    }
 });
 test("add token screen opens from address detail (#150)", async (env) => {
    await openAddressDetail(env.page);
    await env.page.click("#btn-add-token");
@@ -359,11 +685,14 @@ async function leaveTransactionDetail(page) {
    await openAddressDetail(page);
 }
-// Back out to Home from wherever the previous test finished.
+// Back out to Home from wherever the previous test finished, and wait for the
 // save that navigation makes, so a test reading the stored stack next reads
 // the one Home left.
 async function goHome(page) {
    await leaveTransactionDetail(page);
    await page.click("#btn-address-back");
    await visible(page, "#view-main");
    await waitForPersisted(page, "currentView", "main", "back on Home");
 }
 // One field of the popup's state as it was actually persisted, read out of
@@ -1885,12 +2214,6 @@ test("a network switch in Settings shows and removes the testnet banner at once
 // ------------------------------------------------ dust threshold (#233)
 // The popup size README documents the UI as designed for. Pages in this
 // context otherwise get Playwright's 1280x720 default, at which the flash
 // line has room for any plausible message and never wraps — measuring
 // there would pass for every string and prove nothing.
 const POPUP_VIEWPORT = { width: 360, height: 600 };
 // Everything below the flash line that must not move when it fills, plus
 // the height of the line itself. Runs in the page.
 //
@@ -2139,7 +2462,7 @@ test("a password error moves nothing on any screen (#297)", async (env) => {
 // ------------------------------------------ add wallet Import button (#493)
-// At 360x600 the add wallet screen's Import button already starts near the
+// At 396x600 the add wallet screen's Import button already starts near the
 // bottom of the popup, so its password error line sits beside the button
 // rather than above it. Measures the button and the line empty and again
 // filled with the longest error addWallet.js puts there. Runs in the page.
@@ -3431,10 +3754,14 @@ test("six failed receipt lookups in a row end on the unreachable-network message
 // timeout ("<iframe id=\"pwn\"> intercepts pointer events") rather than as
 // anything that names the defect.
-// Verbatim from the issue's reproduction.
+// The issue's reproduction, with the frame sized to the popup.
 const HOSTILE_SYMBOL =
    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
+    'style="position:fixed;left:0;top:0;width:' +
    POPUP_VIEWPORT.width +
    "px;height:" +
    POPUP_VIEWPORT.height +
    'px;z-index:99999"></iframe>';
 // What a correctly escaped and capped render of it reads as: the first
 // MAX_SYMBOL_LENGTH-1 characters and an ellipsis. Spelled out rather than
@@ -3471,6 +3798,24 @@ function hostileSymbolState(page, tokenAddress) {
 }
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
    // The stub token is no longer tracked from here on, so the explorer is
    // what lists it, as it lists a token airdropped to the victim. A tracked
    // token is listed from the RPC endpoint under the symbol it was added
    // with, which the hostile symbol below never reaches
    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
    await env.page.click("#btn-settings");
    await visible(env.page, "#view-settings");
    await env.page.click("#settings-tracked-tokens .btn-remove-token");
    // The list is drawn again once the removal is saved.
    await env.page.waitForFunction(
        () =>
            document
                .getElementById("settings-tracked-tokens")
                .innerText.trim() === "None",
    );
    await env.page.click("#btn-settings-back");
    await visible(env.page, "#view-address");
    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
    env.routeOpts.seedTokenBalance = true;
    env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;
@@ -4856,6 +5201,12 @@ test("a site's network switch changes nothing until the user approves it (#408)"
        "the page was not told of the approved switch: " +
            JSON.stringify(events),
    );
    // The popup, open all along, shows the new network
    // (https://git.eeqj.de/sneak/AutistMask/issues/650).
    await env.page.waitForFunction(() => {
        const banner = document.getElementById("debug-banner");
        return banner !== null && banner.textContent === "[TESTNET]";
    });
    const restored = await openNetworkPrompt(
        env,
@@ -4877,6 +5228,9 @@ test("a site's network switch changes nothing until the user approves it (#408)"
        isDeepStrictEqual(await storedNetwork(env.page), before),
        "switching back did not restore the mainnet network and endpoints",
    );
    await env.page.waitForFunction(
        () => document.getElementById("debug-banner") === null,
    );
 });
 // Switching the network in Settings tells the page too, as an approved site
@@ -5026,8 +5380,20 @@ function addressRowReport(page) {
    });
 }
 // Measured at the popup's 396x600 (POPUP_VIEWPORT). Every page in this
 // context, approval windows included, is otherwise 1280x720 whatever size
 // the extension asks for, and a page that wide never scrolls sideways. The
 // page is then put back to the size it had, so the size a later step runs at
 // does not depend on whether this one ran.
 async function assertAddressesFit(page, where) {
-    const report = await addressRowReport(page);
+    const sizeBefore = page.viewportSize();
    await page.setViewportSize(POPUP_VIEWPORT);
    let report;
    try {
        report = await addressRowReport(page);
    } finally {
        await page.setViewportSize(sizeBefore);
    }
    assert(
        report.rows.length > 0,
        where + ": no address rows were rendered, so nothing was measured",
@@ -5210,10 +5576,17 @@ async function main() {
        seedReceipt: false,
        // Whether eth_getTransactionReceipt fails instead of answering (#315).
        failReceiptLookup: false,
        // The label Etherscan's page gives an address, when it gives one
        // (#668).
        etherscanLabel: null,
        // Every raw signed transaction handed to eth_sendRawTransaction, in
        // order. The dApp transaction round trip asserts against these bytes
        // rather than against anything the extension reported about them.
        broadcastTransactions: [],
        // Every request the extension makes, in order, from when launch()
        // installs the route handler, before the first popup page opens
        // (#668).
        requests: [],
    };
    let session;
@@ -0,0 +1,114 @@
 // ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
 // name is resolved off-chain, naming a web address to fetch the answer from.
 // ethers fetches that address unless the provider has `disableCcipRead` set.
 // That request would carry the name to a server other than the RPC endpoint
 // (https://git.eeqj.de/sneak/AutistMask/issues/668). With the flag set, such a
 // name does not resolve.
 //
 // The test builds its provider with getProvider() and runs it against a fake
 // JSON-RPC node. The fake node answers through ethers' own request hook. The
 // hook also records the address of every request ethers makes, the off-chain
 // fetch included.
 const { FetchRequest, Interface } = require("ethers");
 const { getProvider } = require("../src/shared/balances");
 const RPC_URL = "https://rpc.example.invalid";
 const RESOLVER = "0x5555555555555555555555555555555555555555";
 const USER = "0x1111111111111111111111111111111111111111";
 const NAME = "offchain.eth";
 // The ENS registry's resolver(), and the resolver's functions ethers calls:
 //
 //   - the registry names RESOLVER for every name
 //   - the resolver says it resolves names through resolve()
 //   - it gives NAME as the reverse record of any address
 //   - it answers resolve() with the OffchainLookup error, which says the name
 //     is resolved off-chain
 const ens = new Interface([
    "function resolver(bytes32) view returns (address)",
    "function supportsInterface(bytes4) view returns (bool)",
    "function name(bytes32) view returns (string)",
    "function resolve(bytes, bytes) view returns (bytes)",
    "error OffchainLookup(address sender, string[] urls, bytes callData, bytes4 callbackFunction, bytes extraData)",
 ]);
 let asked;
 // One JSON-RPC answer. Anything but a call to one of the functions above is
 // refused.
 function reply(req) {
    const envelope = { jsonrpc: "2.0", id: req.id };
    const call =
        req.method === "eth_call" ? ens.parseTransaction(req.params[0]) : null;
    if (call === null) {
        return {
            ...envelope,
            error: { code: -32601, message: "method not found" },
        };
    }
    if (call.name === "resolve") {
        const offchain = ens.encodeErrorResult("OffchainLookup", [
            RESOLVER,
            ["https://gateway.example.invalid/{sender}/{data}.json"],
            "0x1234",
            "0x12345678",
            "0x",
        ]);
        return {
            ...envelope,
            error: { code: 3, message: "execution reverted", data: offchain },
        };
    }
    const answers = {
        resolver: [RESOLVER],
        supportsInterface: [true],
        name: [NAME],
    };
    return {
        ...envelope,
        result: ens.encodeFunctionResult(call.name, answers[call.name]),
    };
 }
 beforeEach(() => {
    asked = [];
    FetchRequest.registerGetUrl(async (req) => {
        asked.push(req.url);
        // Any other address is the off-chain fetch, answered as not found.
        if (req.url !== RPC_URL) {
            return {
                statusCode: 404,
                statusMessage: "Not Found",
                headers: {},
                body: null,
            };
        }
        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
        return {
            statusCode: 200,
            statusMessage: "OK",
            headers: { "content-type": "application/json" },
            body: Buffer.from(JSON.stringify(answer)),
        };
    });
 });
 afterEach(() => {
    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
 });
 test("a name typed into Send that is resolved off-chain does not resolve, and only the RPC endpoint is asked", async () => {
    const provider = getProvider(RPC_URL, "mainnet");
    const [outcome] = await Promise.allSettled([provider.resolveName(NAME)]);
    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
    expect(outcome).toEqual({ status: "fulfilled", value: null });
 });
 test("the reverse lookup of a user's address whose name is resolved off-chain finds no name, and only the RPC endpoint is asked", async () => {
    const provider = getProvider(RPC_URL, "mainnet");
    const [outcome] = await Promise.allSettled([provider.lookupAddress(USER)]);
    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
    expect(outcome).toEqual({ status: "fulfilled", value: null });
 });
@@ -35,8 +35,11 @@ global.fetch = jest.fn(() => {
    throw new Error("tests must not perform network requests");
 });
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub() };
+global.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
 };
 const { AbiCoder, Interface } = require("ethers");
 const { ERC20_ABI } = require("../src/shared/constants");
@@ -165,6 +168,9 @@ beforeEach(() => {
    debugFetch.mockReset();
    state.trackedTokens = [];
    state.wallets = [];
    // The approval screens read the explorer's report only while the page's
    // "Use Blockscout" is on.
    state.useBlockscout = true;
 });
 describe("what fetchTokenBalances stores for an absent scale", () => {
@@ -21,7 +21,11 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
    throw new Error("tests must not perform network requests");
 });
-global.chrome = { storage: { local: {} } };
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
 global.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
 };
 const {
    LOW_HOLDER_THRESHOLD,
@@ -151,7 +151,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const { state } = require("../src/shared/state");
 const { NETWORKS } = require("../src/shared/networks");
@@ -436,6 +436,13 @@ describe.each([
        });
        test("the transaction detail screen's type line and fee", async () => {
            // The fee is Blockscout's, asked for only while the stored "Use
            // Blockscout" is on.
            state.useBlockscout = true;
            global.chrome.storage.write("autistmask", {
                ...global.chrome.storage.read("autistmask"),
                useBlockscout: true,
            });
            debugFetch.mockImplementationOnce(async () => ({
                ok: true,
                status: 200,
@@ -286,8 +286,12 @@ describe("a malformed fraudContracts", () => {
    function stubSendDocument() {
        const select = { innerHTML: "", children: [] };
        select.appendChild = (child) => select.children.push(child);
        const elements = {
            "send-token": select,
            "send-tokens-note": { classList: { toggle: () => {} } },
        };
        globalThis.document = {
-            getElementById: (id) => (id === "send-token" ? select : null),
+            getElementById: (id) => elements[id] || null,
            createElement: () => ({ value: "", textContent: "" }),
        };
        return select;
@@ -364,7 +368,7 @@ describe("a save that fails", () => {
        return storage;
    }
-    test("is reported, not swallowed by the save queue", async () => {
+    test("is reported when the caller does not await it", async () => {
        const storage = failingStorage(unversionedValidProfile());
        const { state, loadState, saveState, onSaveFailure } =
            loadStateModule(storage);
@@ -629,6 +629,14 @@ const CONTRACT = [
        // the falsy answer is also the DEFAULT_STATE default.
        falsy: [0],
    })),
    // Each lets a request reach another service, so anything but true is off.
    ...["useBlockscout", "checkRecipientsOnEtherscan"].map((field) => ({
        field,
        kind: KIND.SCALAR,
        hostile: [42, "notabool", { a: 1 }],
        floorOnly: [0, null, "true"],
        holds: (v) => v === false,
    })),
 ];
 function siteMapHolds(v) {
@@ -44,7 +44,9 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
 // A boot onto a screen that sends a request no mocked module answers: that
 // request reaches the boot's fetch() stub, never the internet
-// (https://git.eeqj.de/sneak/AutistMask/issues/559).
+// (https://git.eeqj.de/sneak/AutistMask/issues/559). TransactionDetail asks
 // Blockscout only while "Use Blockscout" is on. ConfirmTx asks Etherscan only
 // while "Check recipients on Etherscan" is on. So the profile turns both on.
 function restoringOnto(view, viewData) {
    return unversionedValidProfile({
        currentView: view,
@@ -52,6 +54,8 @@ function restoringOnto(view, viewData) {
        selectedAddress: 0,
        viewStack: ["main"],
        viewData,
        useBlockscout: true,
        checkRecipientsOnEtherscan: true,
    });
 }
@@ -0,0 +1,300 @@
 // An open popup follows a network switch the background saves once the user
 // approves a site's request: it takes the new network from the stored record
 // and draws the screen it is on for it, as a switch in Settings does
 // (https://git.eeqj.de/sneak/AutistMask/issues/650). Driven through the real
 // popup over a stored profile on Ethereum Mainnet. The background's write is
 // the storage stub's set, which the stub reports to the page as the browser
 // does.
 const {
    bootPopup,
    cleanupPopup,
    unversionedValidProfile,
    TOKEN_ADDRESS,
 } = require("./support/popupBoot");
 const { makeStorageStub } = require("./support/storageStub");
 const {
    applyChainSwitchFields,
    copyChainSwitchFields,
 } = require("../src/shared/chainSwitchFields");
 const { NETWORKS } = require("../src/shared/networks");
 const { STATE_SCHEMA_VERSION } = require("../src/shared/stateSchema");
 afterEach(() => {
    cleanupPopup();
 });
 const SEPOLIA_TOKEN = {
    address: TOKEN_ADDRESS,
    symbol: "TST",
    decimals: 18,
    name: "Test Token",
 };
 const MAINNET_TOKEN = {
    address: "0x6B175474E89094C44Da98b954EedeAC495271d0F",
    symbol: "DAI",
    decimals: 18,
    name: "Dai Stablecoin",
 };
 // A profile on Ethereum Mainnet that reopens the popup onto AddressDetail,
 // with DAI tracked there and TST tracked on Sepolia.
 function profileOnAddress() {
    return unversionedValidProfile({
        currentView: "address",
        viewStack: ["main"],
        selectedWallet: 0,
        selectedAddress: 0,
        trackedTokens: [MAINNET_TOKEN],
        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
    });
 }
 // The popup reopened onto it.
 function bootOnAddress() {
    return bootPopup(profileOnAddress());
 }
 // The background saves a switch to `networkId`, as its updateState() does
 // once the user approves a site's request.
 async function backgroundSwitch(page, networkId) {
    const record = page.storage.read("autistmask");
    applyChainSwitchFields(record, networkId);
    await page.storage.local.set({ autistmask: record });
    await page.settle();
    await page.settle();
 }
 test("the popup open on AddressDetail shows the new network and its balances", async () => {
    const page = await bootOnAddress();
    expect(page.pageErrors).toEqual([]);
    expect(page.visibleViews()).toEqual(["address"]);
    expect(page.node("address-balances").innerHTML).toContain("DAI");
    expect(page.node("debug-banner")).toBeNull();
    await backgroundSwitch(page, "sepolia");
    const { state } = require("../src/shared/state");
    expect(state.networkId).toBe("sepolia");
    expect(state.rpcUrl).toBe(NETWORKS.sepolia.defaultRpcUrl);
    expect(page.visibleViews()).toEqual(["address"]);
    const balances = page.node("address-balances").innerHTML;
    expect(balances).toContain("TST");
    expect(balances).toContain("SepoliaETH");
    expect(balances).not.toContain("DAI");
    expect(page.text("debug-banner")).toBe("[TESTNET]");
    // Its next refresh runs on Sepolia, and what it fetched is stored.
    await page.tick();
    const { refreshBalances } = require("../src/shared/balances");
    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
    const stored = page.storage.read("autistmask");
    expect(stored.networkId).toBe("sepolia");
    expect(stored.lastBalanceRefresh).toBeGreaterThan(0);
 });
 test("the popup open on Settings shows the new network, and Back draws the screen beneath for it", async () => {
    const page = await bootOnAddress();
    await page.click("btn-settings");
    expect(page.visibleViews()).toEqual(["settings"]);
    await backgroundSwitch(page, "sepolia");
    expect(page.visibleViews()).toEqual(["settings"]);
    expect(page.value("settings-network")).toBe("sepolia");
    expect(page.value("settings-rpc")).toBe(NETWORKS.sepolia.defaultRpcUrl);
    expect(page.node("settings-tracked-tokens").innerHTML).toContain("TST");
    expect(page.text("debug-banner")).toBe("[TESTNET]");
    await page.click("btn-settings-back");
    expect(page.visibleViews()).toEqual(["address"]);
    expect(page.node("address-balances").innerHTML).not.toContain("DAI");
 });
 // Neither can be drawn again for the new network: Send cannot be rendered from
 // saved state, and DAI was picked on Ethereum Mainnet, where alone it is
 // tracked. A reopened popup goes to Home in their place.
 test.each([
    ["Send", (page) => page.click("btn-send")],
    [
        "AddressToken for DAI",
        async (page) => {
            const { state } = require("../src/shared/state");
            state.selectedToken = MAINNET_TOKEN.address;
            require("../src/popup/views/helpers").pushCurrentView();
            require("../src/popup/views/addressToken").show();
            await page.settle();
        },
    ],
 ])("the popup open on %s goes to Home", async (_view, open) => {
    const page = await bootOnAddress();
    await open(page);
    expect(page.visibleViews()).not.toEqual(["address"]);
    await backgroundSwitch(page, "sepolia");
    expect(page.visibleViews()).toEqual(["main"]);
    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
 });
 // The report of the switch's own save names the network the page already has.
 test("a switch in Settings is not taken a second time when its save is reported", async () => {
    const page = await bootOnAddress();
    await page.click("btn-settings");
    const { get, set } = page.storage.local;
    const reads = get.mock.calls.length;
    const writes = set.mock.calls.length;
    const select = page.node("settings-network");
    select.value = "sepolia";
    for (const fn of select.listeners.change) await fn();
    await page.settle();
    await page.settle();
    expect(get).toHaveBeenCalledTimes(reads + 1);
    expect(set).toHaveBeenCalledTimes(writes + 1);
    expect(page.text("flash-msg")).toBe("Switched to Sepolia Testnet.");
 });
 // The background saves the switch once the popup has read the stored record
 // and before it listens for changes to it, so the browser tells the page
 // nothing of it. Nor is any later write reported here: Chrome reports none
 // that leaves the record as it was, such as the popup's own save at start-up.
 test("a switch saved while the popup opens, before it listens for one, is followed", async () => {
    const storage = makeStorageStub({ autistmask: profileOnAddress() });
    storage.onChanged = { addListener: () => {} };
    const read = storage.local.get.getMockImplementation();
    storage.local.get.mockImplementationOnce(async (key) => {
        const loaded = await read(key);
        const record = storage.read("autistmask");
        applyChainSwitchFields(record, "sepolia");
        storage.write("autistmask", record);
        return loaded;
    });
    const page = await bootPopup(undefined, { storage });
    await page.settle();
    const { state } = require("../src/shared/state");
    expect(page.pageErrors).toEqual([]);
    expect(state.networkId).toBe("sepolia");
    expect(page.visibleViews()).toEqual(["address"]);
    expect(page.node("address-balances").innerHTML).toContain("SepoliaETH");
    expect(page.text("debug-banner")).toBe("[TESTNET]");
 });
 // While the popup's follow of the background's switch to Sepolia waits for the
 // lock, the user picks Sepolia in Settings and then Ethereum Mainnet again. The
 // last pick is the network stored, and the last one sites are told of.
 test("a switch in Settings made while a follow waits for the lock is not overwritten by it", async () => {
    const page = await bootOnAddress();
    await page.click("btn-settings");
    // Another write holds the lock, so every save of the page waits for it.
    let releaseLock;
    const lockHeld = navigator.locks.request(
        "autistmask",
        () =>
            new Promise((resolve) => {
                releaseLock = resolve;
            }),
    );
    await backgroundSwitch(page, "sepolia");
    const select = page.node("settings-network");
    const picks = [];
    for (const networkId of ["sepolia", "mainnet"]) {
        select.value = networkId;
        for (const fn of select.listeners.change) picks.push(fn());
    }
    releaseLock();
    await lockHeld;
    await Promise.all(picks);
    await page.settle();
    const { state } = require("../src/shared/state");
    expect(state.networkId).toBe("mainnet");
    expect(page.storage.read("autistmask").networkId).toBe("mainnet");
    expect(page.value("settings-network")).toBe("mainnet");
    const told = globalThis.chrome.runtime.sendMessage.mock.calls
        .map(([message]) => message)
        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
 });
 // The popup follows the background's switch to Sepolia, but its own write in
 // that save fails. The user then picks Ethereum Mainnet in Settings, the
 // network the popup was on before: that switch is stored, and only then
 // flashed and sent to sites.
 test("a switch back in Settings after a follow whose write failed is stored", async () => {
    const page = await bootOnAddress();
    await page.click("btn-settings");
    const { set } = page.storage.local;
    const write = set.getMockImplementation();
    // The background's write lands; the next, the follow's, fails.
    set.mockImplementationOnce(write).mockRejectedValueOnce(
        new Error("quota exceeded"),
    );
    await backgroundSwitch(page, "sepolia");
    const { state } = require("../src/shared/state");
    expect(state.networkId).toBe("sepolia");
    const select = page.node("settings-network");
    select.value = "mainnet";
    for (const fn of select.listeners.change) await fn();
    await page.settle();
    const stored = page.storage.read("autistmask");
    expect(stored.networkId).toBe("mainnet");
    expect(stored.rpcUrl).toBe(NETWORKS.mainnet.defaultRpcUrl);
    expect(stored.trackedTokens).toEqual([MAINNET_TOKEN]);
    expect(page.text("flash-msg")).toBe("Switched to Ethereum Mainnet.");
    const told = globalThis.chrome.runtime.sendMessage.mock.calls
        .map(([message]) => message)
        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
 });
 // Such as one a newer build wrote, which this build cannot read. Nothing reads
 // or writes the stored record for it: the popup's next save finds it, as
 // before.
 test("a record that names no network is not followed", async () => {
    const page = await bootOnAddress();
    const { get, set } = page.storage.local;
    const reads = get.mock.calls.length;
    await set({
        autistmask: {
            schemaVersion: STATE_SCHEMA_VERSION + 1,
            wallets: [{ type: "hd", name: "Main", addresses: [] }],
        },
    });
    await page.settle();
    expect(get).toHaveBeenCalledTimes(reads);
    expect(page.visibleViews()).toEqual(["address"]);
 });
 // A record that takes the switch from the switched record ends up as that
 // record, balances the background fetched since included.
 test("copyChainSwitchFields() takes every field applyChainSwitchFields() sets", () => {
    const before = unversionedValidProfile({
        trackedTokens: [MAINNET_TOKEN],
        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
        networkEndpoints: {
            sepolia: {
                rpcUrl: "http://127.0.0.1:8545",
                blockscoutUrl: "http://127.0.0.1:4000/api/v2",
            },
        },
        lastBalanceRefresh: 1,
        tokenHolderCache: { [MAINNET_TOKEN.address]: 5000 },
        fraudContracts: ["0x1111111111111111111111111111111111111111"],
    });
    const switched = structuredClone(before);
    applyChainSwitchFields(switched, "sepolia");
    switched.wallets[0].addresses[0].balance = "2.0";
    const follower = structuredClone(before);
    copyChainSwitchFields(follower, switched);
    expect(follower).toEqual(switched);
 });
@@ -97,7 +97,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const { state } = require("../src/shared/state");
 const send = require("../src/popup/views/send");
@@ -90,7 +90,7 @@ let approvalDetails = null;
 const { makeStorageStub } = require("./support/storageStub");
 global.chrome = {
-    storage: makeStorageStub(),
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
    runtime: {
        connect: () => ({
            postMessage() {},
@@ -151,7 +151,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const { refreshBalances } = require("../src/shared/balances");
 const { state } = require("../src/shared/state");
@@ -220,6 +220,10 @@ async function refreshWith(balanceWei, tokenItems = []) {
    state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    // Blockscout is asked only while the stored "Use Blockscout" is on. The
    // screens save this page's copy of "Use Blockscout" over the stored one. So
    // the page's copy is turned on here too.
    state.useBlockscout = true;
    await refreshBalances(
        state.wallets,
        "https://rpc.example.invalid",
@@ -100,7 +100,10 @@ global.fetch = jest.fn(() => {
 });
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
    runtime: { sendMessage() {} },
 };
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -146,7 +149,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const { Transaction, Wallet, formatEther } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");
@@ -213,6 +216,10 @@ async function refreshWith(balanceWei, tokenItems = []) {
    ];
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    // Blockscout is asked only while the stored "Use Blockscout" is on. The
    // screens save this page's copy of "Use Blockscout" over the stored one. So
    // the page's copy is turned on here too.
    state.useBlockscout = true;
    await refreshBalances(
        state.wallets,
        "https://rpc.example.invalid",
@@ -27,8 +27,12 @@ let select;
 function installStubDocument() {
    select = { innerHTML: "", children: [] };
    select.appendChild = (child) => select.children.push(child);
    const elements = {
        "send-token": select,
        "send-tokens-note": { classList: { toggle: () => {} } },
    };
    globalThis.document = {
-        getElementById: (id) => (id === "send-token" ? select : null),
+        getElementById: (id) => elements[id] || null,
        createElement: () => ({ value: "", textContent: "" }),
    };
 }
@@ -160,7 +160,7 @@ describe("the approval-window reproduction", () => {
        await approvalWindow.state.loadState();
        approvalWindow.helpers.showView("approve-tx");
        // showView() does not await its own saveState(); an extra save
-        // joins the same queue and only resolves once that one has too,
+        // waits for the lock behind that one and so resolves only after it,
        // which is the black-box way to know it landed.
        await approvalWindow.state.saveState();
@@ -523,13 +523,16 @@ describe("a garbage value in a field the gate does not check", () => {
    });
    test("a malformed tokenBalances entry is dropped, and the wallet and its address survive", async () => {
-        const env = await bootPopup(
+        // "Use Blockscout" is on. Otherwise the boot's balance refresh would
-            profileWithTokenBalances([
+        // drop the well-formed entry too, since the user has not tracked its
-                null,
+        // token.
-                42,
+        const profile = profileWithTokenBalances([
-                { address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
+            null,
-            ]),
+            42,
-        );
+            { address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
        ]);
        profile.useBlockscout = true;
        const env = await bootPopup(profile);
        const stored = env.storage.read("autistmask");
        expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
@@ -0,0 +1,96 @@
 // A popup save reads the stored record, merges this page's changes into it
 // and writes it back. The background's write of a network the user approved
 // used to be able to land between that read and that write, and the popup's
 // write then put the old network back
 // (https://git.eeqj.de/sneak/AutistMask/issues/641). Every write of the record
 // now holds a lock from its read to its write.
 //
 // The popup and the background run here as the real modules over one shared
 // storage stub, and share the lock the way the background and a page outside
 // a Firefox private window share the browser's
 // (tests/support/navigatorLocks.js).
 const { makeStorageStub } = require("./support/storageStub");
 function loadContexts(storage) {
    jest.resetModules();
    globalThis.chrome = { storage: { local: storage.local } };
    return {
        popup: require("../src/shared/state"),
        background: require("../src/background/state"),
        applyChainSwitchFields: require("../src/shared/chainSwitchFields")
            .applyChainSwitchFields,
    };
 }
 // Lets every pending promise callback run, and then some.
 function nextMacrotask() {
    return new Promise((resolve) => setImmediate(resolve));
 }
 afterEach(() => {
    delete globalThis.chrome;
    jest.restoreAllMocks();
 });
 test("a network the background switches to during a popup save stays stored", async () => {
    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
    await popup.loadState();
    // The popup navigates, so its save has a change of its own to write.
    popup.state.currentView = "settings";
    // The popup's save has read the record and is about to write it back when
    // the user's approval of a site's switch to mainnet reaches the
    // background. Without the lock the background's whole update runs before
    // the next macrotask; with it, the update waits for the popup's write.
    let backgroundSwitch;
    const realSet = storage.local.set.getMockImplementation();
    storage.local.set.mockImplementationOnce(async (items) => {
        backgroundSwitch = background.updateState((fresh) =>
            applyChainSwitchFields(fresh, "mainnet"),
        );
        await nextMacrotask();
        return realSet(items);
    });
    await popup.saveState();
    await backgroundSwitch;
    const stored = storage.read("autistmask");
    expect(stored.networkId).toBe("mainnet");
    expect(stored.currentView).toBe("settings");
 });
 test("after a save that failed, the next save still keeps a network the background switches to during it", async () => {
    jest.spyOn(console, "error").mockImplementation(() => {});
    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
    await popup.loadState();
    popup.state.currentView = "settings";
    // The first save's write is refused, so it gives the lock back having
    // failed.
    storage.local.set.mockRejectedValueOnce(new Error("quota exceeded"));
    await expect(popup.saveState()).rejects.toThrow("quota exceeded");
    // The next save is between its read and its write when the background
    // switches to mainnet, as in the test above.
    let backgroundSwitch;
    const realSet = storage.local.set.getMockImplementation();
    storage.local.set.mockImplementationOnce(async (items) => {
        backgroundSwitch = background.updateState((fresh) =>
            applyChainSwitchFields(fresh, "mainnet"),
        );
        await nextMacrotask();
        return realSet(items);
    });
    await popup.saveState();
    await backgroundSwitch;
    const stored = storage.read("autistmask");
    expect(stored.networkId).toBe("mainnet");
    expect(stored.currentView).toBe("settings");
 });
@@ -0,0 +1,27 @@
 // `navigator.locks` for the unit tests, which run on node, where there is none.
 //
 // One lock per name: granted in the order it was asked for, and let go when
 // the callback settles, whether it resolved or rejected. That is what the
 // browser's own does for the one call the extension makes,
 // `navigator.locks.request(name, callback)`. Every module a test file loads
 // shares it, as the extension's background and its pages share the browser's,
 // except a page in a Firefox private window (README, "Stored state and its
 // version").
 //
 // Run before each test file by `setupFiles` in package.json.
 // For each name, a promise that settles once the last request for it has
 // let the lock go.
 const released = new Map();
 function request(name, callback) {
    const previous = released.get(name) || Promise.resolve();
    const result = previous.then(() => callback({ name, mode: "exclusive" }));
    released.set(
        name,
        result.catch(() => {}),
    );
    return result;
 }
 globalThis.navigator = { locks: { request } };
@@ -283,6 +283,8 @@ async function bootPopup(stored, options) {
    jest.doMock("../../src/shared/balances", () => ({
        fetchTokenBalances: jest.fn(async () => []),
        refreshBalances: jest.fn(async () => {}),
        dropUntrackedTokens: jest.requireActual("../../src/shared/balances")
            .dropUntrackedTokens,
        lookupTokenInfo: jest.fn(async () => null),
        getProvider: () => ({}),
        scanForAddresses: jest.fn(async () => ({
@@ -311,7 +313,7 @@ async function bootPopup(stored, options) {
    const windowListeners = {};
    globalThis.chrome = {
-        storage: { local: storage.local },
+        storage: { local: storage.local, onChanged: storage.onChanged },
        runtime: {
            sendMessage: jest.fn(async () => ({})),
            getURL: (p) => "chrome-extension://autistmask/" + p,
@@ -18,7 +18,9 @@
 // a storage stub by hand.
 // One storage area: get, set and remove over its own store, cloning both ways.
-function makeArea(store, tick) {
+// `changed` is handed what each set or remove changed, in the shape
 // storage.onChanged reports it.
 function makeArea(store, tick, changed) {
    const get = jest.fn(async (key) => {
        tick();
        if (key === undefined || key === null) return structuredClone(store);
@@ -34,14 +36,25 @@ function makeArea(store, tick) {
    const set = jest.fn(async (items) => {
        tick();
        const changes = {};
        for (const k of Object.keys(items)) {
            changes[k] = structuredClone({
                oldValue: store[k],
                newValue: items[k],
            });
            store[k] = structuredClone(items[k]);
        }
        changed(changes);
    });
    const remove = jest.fn(async (key) => {
        tick();
-        for (const k of Array.isArray(key) ? key : [key]) delete store[k];
+        const changes = {};
        for (const k of Array.isArray(key) ? key : [key]) {
            changes[k] = { oldValue: store[k] };
            delete store[k];
        }
        changed(changes);
    });
    return { get, set, remove };
@@ -54,12 +67,22 @@ function makeArea(store, tick) {
 function makeStorageStub(initial, onOp) {
    const store = initial ? structuredClone(initial) : {};
    const tick = onOp || (() => {});
-    const local = makeArea(store, tick);
+    // storage.onChanged: after a set or remove has finished, every listener is
    // called with what it changed and the area's name, as the browser calls
    // them for a write by any page or the background.
    const listeners = [];
    const announce = (areaName) => (changes) => {
        Promise.resolve().then(() => {
            for (const fn of listeners) fn(structuredClone(changes), areaName);
        });
    };
    const local = makeArea(store, tick, announce("local"));
    return {
        // Drop this straight in as chrome.storage.
        local,
-        session: makeArea({}, tick),
+        session: makeArea({}, tick, announce("session")),
        onChanged: { addListener: (fn) => listeners.push(fn) },
        get: local.get,
        set: local.set,
        remove: local.remove,
@@ -71,7 +94,9 @@ function makeStorageStub(initial, onOp) {
                ? structuredClone(store)
                : structuredClone(store[key]),
        // Seed or replace a record without going through the module under
-        // test — for standing in as "another page wrote this".
+        // test — for standing in as "another page wrote this". Nothing is
        // announced to storage.onChanged, so it also stands in for the time
        // before the browser tells this page of such a write.
        write: (key, value) => {
            store[key] = structuredClone(value);
        },
@@ -52,8 +52,14 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
    throw new Error("tests must not perform network requests");
 });
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 global.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
        local: {
            get: async () => ({ autistmask: { useBlockscout: true } }),
            set: async () => {},
        },
    },
 };
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
@@ -485,8 +491,12 @@ describe("surface 2: the Send token selector", () => {
    function render(tokenBalances) {
        select = { innerHTML: "", children: [] };
        select.appendChild = (child) => select.children.push(child);
        const elements = {
            "send-token": select,
            "send-tokens-note": { classList: { toggle: () => {} } },
        };
        globalThis.document = {
-            getElementById: (id) => (id === "send-token" ? select : null),
+            getElementById: (id) => elements[id] || null,
            createElement: () => ({ value: "", textContent: "" }),
        };
        renderSendTokenSelect({
@@ -134,6 +134,8 @@ beforeEach(() => {
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    state.selectedToken = "ETH";
    // The history is Blockscout's.
    state.useBlockscout = true;
 });
 describe.each([
@@ -38,8 +38,14 @@ jest.mock("../src/shared/log", () => ({
    isDebug: () => false,
 }));
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
        local: {
            get: async () => ({ autistmask: { useBlockscout: true } }),
            set: async () => {},
        },
    },
 };
 const { state } = require("../src/shared/state");
@@ -158,6 +164,7 @@ beforeEach(() => {
    globalThis.document = makeDocument();
    globalThis.window = { location: { search: "" } };
    state.blockscoutUrl = EXPLORER;
    state.useBlockscout = true;
    state.networkEndpoints = {};
    state.wallets = [
        {
@@ -0,0 +1,309 @@
 // The balance of each token the user tracks is read with balanceOf through the
 // RPC endpoint, for every address. Blockscout's answer gives a tracked token its
 // holder count and decimals, and adds the tokens the user has not tracked
 // (https://git.eeqj.de/sneak/AutistMask/issues/669).
 //
 // The real refreshBalances() runs against a fake JSON-RPC node, answered
 // through ethers' own request hook, and a fake Blockscout, answered through
 // fetch().
 const { AbiCoder, FetchRequest } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");
 const { makeStorageStub } = require("./support/storageStub");
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
 };
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const FIRST = "0x1111111111111111111111111111111111111111";
 const SECOND = "0x2222222222222222222222222222222222222222";
 // A token the user tracks, outside the bundled list, at 6 decimals.
 const TOKEN = "0x7777777777777777777777777777777777777777";
 const TRACKED = {
    address: TOKEN,
    symbol: "TRK",
    name: "Tracked Token",
    decimals: 6,
 };
 // USDC, from the bundled list, which the user does not track.
 const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
 // Neither on the bundled list nor tracked.
 const OTHER = "0x8888888888888888888888888888888888888888";
 const ZERO_WORD = "0x" + "0".repeat(64);
 const BALANCE_OF = "0x70a08231";
 // What balanceOf answers, by token contract and then by holder. A pair that is
 // not here makes balanceOf fail.
 let holdings;
 // What Blockscout answers for every address; null makes the request fail.
 let explorerRows;
 let logged;
 // One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
 // answered with no resolver, so no name.
 function reply(req) {
    const envelope = { jsonrpc: "2.0", id: req.id };
    if (req.method === "eth_getBalance") {
        return { ...envelope, result: "0x0" };
    }
    if (req.method !== "eth_call") {
        return {
            ...envelope,
            error: { code: -32601, message: "method not found" },
        };
    }
    const { to, data } = req.params[0];
    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
    const holder = "0x" + data.slice(-40);
    const amount = (holdings[to.toLowerCase()] || {})[holder];
    if (amount === undefined) {
        return {
            ...envelope,
            error: { code: -32000, message: "fixture: balanceOf failed" },
        };
    }
    return {
        ...envelope,
        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
    };
 }
 const realFetch = globalThis.fetch;
 beforeEach(() => {
    holdings = {};
    explorerRows = null;
    logged = [];
    jest.spyOn(console, "error").mockImplementation((...args) => {
        logged.push(args.map(String).join(" "));
    });
    FetchRequest.registerGetUrl(async (req) => {
        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
        return {
            statusCode: 200,
            statusMessage: "OK",
            headers: { "content-type": "application/json" },
            body: Buffer.from(JSON.stringify(answer)),
        };
    });
    globalThis.fetch = jest.fn(async () => {
        if (explorerRows === null) throw new TypeError("Failed to fetch");
        return { ok: true, status: 200, json: async () => explorerRows };
    });
 });
 afterEach(() => {
    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
    globalThis.fetch = realFetch;
    jest.restoreAllMocks();
 });
 // One Blockscout token-balances row.
 function explorerRow(address, symbol, value, holders = "50000") {
    return {
        value: String(value),
        token: {
            type: "ERC-20",
            address_hash: address,
            symbol: symbol,
            name: symbol,
            decimals: "6",
            holders_count: holders,
        },
    };
 }
 // The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
 // decimals and holder count Blockscout reported for it, if any.
 function trackedRow(balance, decimals = null, holders = null) {
    return {
        address: TOKEN,
        name: "Tracked Token",
        symbol: "TRK",
        decimals: decimals,
        balance: balance,
        holders: holders,
    };
 }
 async function refresh(addresses, trackedTokens) {
    await refreshBalances(
        [{ addresses }],
        RPC_URL,
        EXPLORER_URL,
        trackedTokens,
        "mainnet",
        new AbortController().signal,
    );
    return addresses;
 }
 test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
    const [first, second] = await refresh(
        [
            { address: FIRST, tokenBalances: [] },
            { address: SECOND, tokenBalances: [] },
        ],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
    // Exact, never cut: one base unit is not zero.
    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
 });
 test("with Blockscout failing, the untracked rows from before stay", async () => {
    holdings[TOKEN] = { [FIRST]: 2000000n };
    const usdc = {
        address: USDC,
        name: "USD Coin",
        symbol: "USDC",
        decimals: 6,
        balance: "5.0",
        holders: 50000,
    };
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [usdc] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
 });
 test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
    holdings[TOKEN] = { [FIRST]: 2000000n };
    explorerRows = [
        explorerRow(TOKEN, "TRK", 9000000),
        explorerRow(USDC, "USDC", 5000000),
        // Too few holders, and neither on the bundled list nor tracked.
        explorerRow(OTHER, "SPAM", 5000000, "10"),
        // A known symbol from a contract it does not belong to.
        explorerRow(OTHER, "USDC", 5000000),
    ];
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([
        trackedRow("2.0", 6, 50000),
        {
            address: USDC,
            name: "USDC",
            symbol: "USDC",
            decimals: 6,
            balance: "5.0",
            holders: 50000,
        },
    ]);
 });
 test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
    holdings[TOKEN] = { [FIRST]: 2000000n };
    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
    // through to Send's token list.
    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
 });
 test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
    holdings[TOKEN] = { [FIRST]: 2000000n };
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
 });
 test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
    const before = trackedRow("7.0", 6, 50000);
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [before] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([before]);
    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
        true,
    );
 });
 test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
    // balanceOf fails at FIRST and answers at SECOND.
    holdings[TOKEN] = { [SECOND]: 2000000n };
    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
    const [first, second] = await refresh(
        [
            { address: FIRST, tokenBalances: [] },
            { address: SECOND, tokenBalances: [] },
        ],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([
        {
            address: TOKEN,
            name: "TRK",
            symbol: "TRK",
            decimals: 6,
            balance: "9.0",
            holders: 50000,
        },
    ]);
    // Where balanceOf answers, its figure stands.
    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
 });
 test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
    holdings[TOKEN] = { [FIRST]: 0n };
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
        [TRACKED],
    );
    expect(first.tokenBalances).toEqual([]);
 });
 test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
    holdings[TOKEN] = { [FIRST]: 5n };
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [] }],
        [{ ...TRACKED, decimals: null }],
    );
    expect(first.tokenBalances).toEqual([trackedRow(null)]);
 });
 test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
    holdings[TOKEN] = { [FIRST]: 2000000n };
    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [] }],
        [{ ...TRACKED, decimals: null }],
    );
    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
 });
 test("a tracked token wearing a known symbol from another contract is not listed", async () => {
    holdings[OTHER] = { [FIRST]: 5000000n };
    // Its entry from before goes too, although Blockscout fails.
    const before = {
        address: OTHER,
        name: "Fake",
        symbol: "USDC",
        decimals: 6,
        balance: "5.0",
        holders: 50000,
    };
    const [first] = await refresh(
        [{ address: FIRST, tokenBalances: [before] }],
        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
    );
    expect(first.tokenBalances).toEqual([]);
 });
@@ -161,6 +161,7 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
    );
    expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
    await boot.click("btn-settings");
    await chooseNetwork(boot, "mainnet");
    expect(stored().networkId).toBe("mainnet");
    expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);
@@ -286,6 +287,7 @@ describe("Back after a switch from the Settings gear", () => {
                currentView: "confirm-tx",
                selectedWallet: 0,
                selectedAddress: 0,
                checkRecipientsOnEtherscan: true,
                viewData: {
                    pendingTx: {
                        token: "ETH",
@@ -125,6 +125,8 @@ beforeEach(() => {
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    state.selectedToken = "ETH";
    // The history is Blockscout's.
    state.useBlockscout = true;
 });
 afterEach(() => {
@@ -1215,6 +1215,8 @@ function respondWith(txItems, tokenTransferItems) {
 describe("fetchRecentTransactions merge and dedup", () => {
    beforeEach(() => {
        debugFetch.mockReset();
        // Blockscout is asked only while the stored "Use Blockscout" is on.
        global.chrome.storage.write("autistmask", { useBlockscout: true });
    });
    test("queries only the two Blockscout endpoints for the address", async () => {
@@ -7,9 +7,12 @@
 // (https://git.eeqj.de/sneak/AutistMask/issues/592), the address whose
 // balance a BALANCE_CHECK_ERC20 checks
 // (https://git.eeqj.de/sneak/AutistMask/issues/600), any token a swap
-// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606), and
+// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606),
 // what each PERMIT2_TRANSFER_FROM moves
-// (https://git.eeqj.de/sneak/AutistMask/issues/611).
+// (https://git.eeqj.de/sneak/AutistMask/issues/611), and when an
 // UNWRAP_WETH makes the output ETH
 // (https://git.eeqj.de/sneak/AutistMask/issues/607 and
 // https://git.eeqj.de/sneak/AutistMask/issues/642).
 //
 // Every swap command, SWEEP, WRAP_ETH, UNWRAP_WETH, TRANSFER, PAY_PORTION,
 // PAY_PORTION_FULL_PRECISION, PERMIT2_TRANSFER_FROM, ACROSS_V4_DEPOSIT_V3 and
@@ -39,8 +42,14 @@ jest.mock("../src/shared/log", () => ({
    isDebug: () => false,
 }));
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
        local: {
            get: async () => ({ autistmask: { useBlockscout: true } }),
            set: async () => {},
        },
    },
 };
 const uniswap = require("../src/shared/uniswap");
@@ -268,18 +277,28 @@ const SWAP_USDT_FOR_ETH = [
        [[[ZERO, USDT, 500, 10, ZERO], false, USDT_2000, ONE_WETH, "0x"]],
    ),
 ];
 const SWAP_USDT_FOR_WETH = [
    0x06, // SWAP_EXACT_IN_SINGLE
    coder.encode(
        [
            "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
        ],
        [[[USDT, WETH, 500, 10, ZERO], true, USDT_2000, ONE_WETH, "0x"]],
    ),
 ];
 // SWAP_EXACT_IN_SINGLE with no parameters, which cannot be read.
 const UNREADABLE_SWAP = [0x06, "0x"];
 const SETTLE_USDT = [
    0x0b,
    coder.encode(["address", "uint256", "bool"], [USDT, 0n, true]),
 ];
-function take(currency, recipient) {
+// A TAKE of `amount`, by default zero: the open delta, all the step owes.
 function take(currency, recipient, amount = 0n) {
    return [
        0x0e,
        coder.encode(
            ["address", "address", "uint256"],
-            [currency, recipient, 0n],
+            [currency, recipient, amount],
        ),
    ];
 }
@@ -531,7 +550,7 @@ describe("an output left in the router is not received", () => {
        {
            kind: "an UNWRAP_WETH to the user, then the swap",
            data: execute(unwrapWeth(MSG_SENDER), toRouter),
-            min: "1.0000 ETH",
+            min: "1.0000 WETH",
        },
        {
            kind: "the swap, then a WRAP_ETH of zero to the user",
@@ -568,6 +587,530 @@ describe("an output left in the router is not received", () => {
    });
 });
 // https://git.eeqj.de/sneak/AutistMask/issues/607: an UNWRAP_WETH pays out,
 // as ETH, the WETH the router holds when it runs. Token Out read ETH whenever
 // the output side was WETH, so a swap that paid its WETH to the user before
 // the UNWRAP_WETH read as ETH, though the user receives WETH.
 describe("an UNWRAP_WETH makes the output ETH only when the router holds it", () => {
    test("a swap paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
        const result = decode(
            execute(swapToWeth(MSG_SENDER), unwrapWeth(MSG_SENDER)),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(labels(result)).toEqual(PAID_TO_USER);
        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
    });
    test("a swap paying its WETH to the router, then an UNWRAP_WETH to the user, reads as ETH", () => {
        const result = decode(
            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER)),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(labels(result)).toEqual(PAID_TO_USER);
        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
    });
    // The SWEEP pays the user all the WETH the router holds, so the
    // UNWRAP_WETH finds none of it.
    test("a swap paying its WETH to the router, then a SWEEP of it to the user, then an UNWRAP_WETH, reads as WETH", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                sweep(WETH, MSG_SENDER),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
    });
    // The user receives the first step's WETH as WETH and the second's as
    // ETH. The second step sets the output side and pays its WETH to the
    // router, so the output reads as ETH with the second step's minimum.
    test("two swaps, the second paying its WETH to the router, then an UNWRAP_WETH, reads as ETH", () => {
        const result = decode(
            execute(
                swapToWeth(MSG_SENDER),
                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
                    USDC,
                    WETH,
                ]),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(detail(result, "Min. received").value).toBe("0.5000 ETH");
    });
    // The same two swaps the other way round. The user receives the first
    // step's WETH as ETH and the second's as WETH. The second step sets the
    // output side and pays its WETH to the user, so the output reads as WETH
    // with the second step's minimum, though the router holds the first's.
    test("two swaps, the second paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
        const result = decode(
            execute(
                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
                    USDC,
                    WETH,
                ]),
                swapToWeth(MSG_SENDER),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDC → WETH");
        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
    });
    // One V4 step buys at least 1 WETH and TAKEs 0.6 WETH to the user and the
    // rest to the router. The user receives 0.6 WETH and the rest as ETH.
    // Neither minimum is shown: the decoder does not count how much of the
    // step's minimum reaches the router, nor read the UNWRAP_WETH's own.
    test("one V4 step paying part of its WETH to the user and the rest to the router, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
        const result = decode(
            execute(
                v4Swap(
                    SWAP_USDT_FOR_WETH,
                    SETTLE_USDT,
                    take(WETH, MSG_SENDER, (ONE_WETH * 6n) / 10n),
                    take(WETH, ADDRESS_THIS),
                ),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(labels(result)).toEqual([
            "Protocol",
            "Token In",
            "Amount",
            "Token Out",
            "Steps",
            "Deadline",
        ]);
    });
    // A TAKE the decoder cannot read may pay part of the WETH to the user.
    test("one V4 step paying WETH to the router beside a TAKE that cannot be read, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
        const result = decode(
            execute(
                v4Swap(
                    SWAP_USDT_FOR_WETH,
                    SETTLE_USDT,
                    withDirtyWord(take(WETH, MSG_SENDER), 1),
                    take(WETH, ADDRESS_THIS),
                ),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(detail(result, "Min. received")).toBeUndefined();
        expect(detail(result, "Min. paid out")).toBeUndefined();
    });
    // A step after the UNWRAP_WETH that sets the output side sets it anew.
    test("a swap paying WETH to the user after an UNWRAP_WETH of an earlier swap's WETH reads as WETH", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                unwrapWeth(MSG_SENDER),
                v2Swap(0x08, MSG_SENDER, USDC_1990, ONE_WETH / 2n, [
                    USDC,
                    WETH,
                ]),
            ),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(detail(result, "Min. received").value).toBe("0.5000 WETH");
    });
    // The EXECUTE_SUB_PLAN's own steps, which the decoder does not read, buy
    // the user USDC as well, so Token Out is not named.
    test("a swap paying its WETH to the router, then an UNWRAP_WETH, then an EXECUTE_SUB_PLAN, names no Token Out", () => {
        const subPlan = [
            0x21,
            coder.encode(
                ["bytes", "bytes[]"],
                [
                    "0x00",
                    [
                        v3SwapExactIn(
                            MSG_SENDER,
                            USDT_2000,
                            USDC_1990,
                            USDT,
                            USDC,
                        )[1],
                    ],
                ],
            ),
        ];
        const result = decode(
            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER), subPlan),
        );
        expect(result.name).toBe("Uniswap Swap");
        expect(detail(result, "Token Out").value).toBe(UNDECODED);
        expect(detail(result, "Min. received")).toBeUndefined();
    });
 });
 // https://git.eeqj.de/sneak/AutistMask/issues/642: a step between the swap and
 // the UNWRAP_WETH may take WETH out of the router or pay it WETH, and a step
 // after an UNWRAP_WETH into the router may pay its ETH out as WETH, yet each
 // route read as ETH with the swap's minimum. A step the decoder read that is a
 // PERMIT2_PERMIT, a BALANCE_CHECK_ERC20, or a SWEEP, TRANSFER, PAY_PORTION or
 // PAY_PORTION_FULL_PRECISION of a token other than WETH, and not of ETH to a
 // WETH contract, cannot take WETH out of the router or pay anyone WETH; the
 // decoder treats every other step as one that may.
 describe("what reaches the UNWRAP_WETH of the swap's WETH", () => {
    const NO_MINIMUM_TO_USER = PAID_TO_USER.filter(
        (l) => l !== "Min. received",
    );
    const NO_MINIMUM_ELSEWHERE = PAID_ELSEWHERE.filter(
        (l) => l !== "Min. paid out",
    );
    test.each([
        {
            kind: "a TRANSFER of 0.0025 WETH",
            step: transfer(0x05, WETH, OTHER, ONE_WETH / 400n),
        },
        {
            kind: "a PAY_PORTION of 25 bips",
            step: transfer(0x06, WETH, OTHER, 25n),
        },
        {
            kind: "a PAY_PORTION_FULL_PRECISION of 1e15",
            step: transfer(0x07, WETH, OTHER, 10n ** 15n),
        },
    ])(
        "$kind to another address between them reads as ETH with no minimum",
        ({ step }) => {
            const result = decode(
                execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
                USER,
                ROUTER_V2_1_2,
            );
            expect(result.name).toBe("Swap USDT → ETH");
            expect(labels(result)).toEqual(NO_MINIMUM_ELSEWHERE);
            expect(paidTo(result)).toEqual([OTHER]);
        },
    );
    test.each([
        {
            kind: "a SWEEP whose recipient cannot be read",
            step: withDirtyWord(sweep(WETH, OTHER), 1),
        },
        {
            kind: "a V4 SETTLE of 0.5 WETH from the router",
            step: v4Swap([
                0x0b,
                coder.encode(
                    ["address", "uint256", "bool"],
                    [WETH, ONE_WETH / 2n, false],
                ),
            ]),
        },
        {
            kind: "a bridge deposit of 0.5 WETH",
            step: acrossDeposit(USER, USER, WETH, ONE_WETH / 2n),
        },
        {
            kind: "a PERMIT2_TRANSFER_FROM of 0.5 WETH into the router",
            step: permit2TransferFrom(WETH, ADDRESS_THIS, ONE_WETH / 2n),
        },
    ])("$kind between them reads as ETH with no minimum", ({ step }) => {
        const result = decode(
            execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(detail(result, "Min. received")).toBeUndefined();
        expect(detail(result, "Min. paid out")).toBeUndefined();
    });
    test.each([
        {
            kind: "a PERMIT2_PERMIT between them",
            steps: [permit2Permit(USDT, USDT_2000), unwrapWeth(MSG_SENDER)],
        },
        {
            kind: "a BALANCE_CHECK_ERC20 of another address between them",
            steps: [balanceCheck(USDC, 1n, OTHER), unwrapWeth(MSG_SENDER)],
        },
        {
            kind: "a BALANCE_CHECK_ERC20 of the sender with a zero minimum between them",
            steps: [balanceCheck(USDC, 0n), unwrapWeth(MSG_SENDER)],
        },
        {
            kind: "a SWEEP of USDC between them",
            steps: [sweep(USDC, MSG_SENDER), unwrapWeth(MSG_SENDER)],
        },
        {
            kind: "an UNWRAP_WETH into the router, then a SWEEP of its ETH,",
            steps: [unwrapWeth(ADDRESS_THIS), sweep(ZERO, MSG_SENDER)],
        },
    ])("$kind reads as ETH with the swap's minimum", ({ steps }) => {
        const result = decode(execute(swapToWeth(ADDRESS_THIS), ...steps));
        expect(result.name).toBe("Swap USDT → ETH");
        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
    });
    test("a V4 step that TAKEs its WETH to the router, then an UNWRAP_WETH to the user, reads as ETH with the swap's minimum", () => {
        const result = decode(
            execute(
                v4Swap(
                    SWAP_USDT_FOR_WETH,
                    SETTLE_USDT,
                    take(WETH, ADDRESS_THIS),
                ),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
    });
    test.each([
        {
            kind: "a TRANSFER of 100 USDC",
            step: transfer(0x05, USDC, OTHER, 100000000n),
        },
        {
            kind: "a PAY_PORTION of 25 bips of USDC",
            step: transfer(0x06, USDC, OTHER, 25n),
        },
        {
            kind: "a PAY_PORTION_FULL_PRECISION of 1e15 of USDC",
            step: transfer(0x07, USDC, OTHER, 10n ** 15n),
        },
    ])(
        "$kind to another address between them reads as ETH with the swap's minimum",
        ({ step }) => {
            const result = decode(
                execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
                USER,
                ROUTER_V2_1_2,
            );
            expect(result.name).toBe("Swap USDT → ETH");
            expect(paidTo(result)).toEqual([OTHER]);
            expect(detail(result, "Min. paid out").value).toBe("1.0000 ETH");
        },
    );
    test.each([
        {
            kind: "a TRANSFER of 0.0025 ETH",
            step: transfer(0x05, ZERO, OTHER, ONE_WETH / 400n),
        },
        {
            kind: "a PAY_PORTION of 25 bips of its ETH",
            step: transfer(0x06, ZERO, OTHER, 25n),
        },
        {
            kind: "a PAY_PORTION_FULL_PRECISION of 1e15 of its ETH",
            step: transfer(0x07, ZERO, OTHER, 10n ** 15n),
        },
    ])(
        "an UNWRAP_WETH into the router, then $kind to another address, then a SWEEP of its ETH to the user, reads as ETH with the swap's minimum",
        ({ step }) => {
            const result = decode(
                execute(
                    swapToWeth(ADDRESS_THIS),
                    unwrapWeth(ADDRESS_THIS),
                    step,
                    sweep(ZERO, MSG_SENDER),
                ),
                USER,
                ROUTER_V2_1_2,
            );
            expect(result.name).toBe("Swap USDT → ETH");
            expect(paidTo(result)).toEqual([OTHER]);
            expect(detail(result, "Min. paid out").value).toBe("1.0000 ETH");
        },
    );
    // The SWEEP pays the user the swap's WETH, so the UNWRAP_WETH unwraps the
    // WRAP_ETH's.
    test("a SWEEP of the swap's WETH to the user, then a WRAP_ETH into the router, reads as ETH with no minimum", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                sweep(WETH, MSG_SENDER),
                wrapEth(ADDRESS_THIS, ONE_WETH),
                unwrapWeth(MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → ETH");
        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
    });
    test("an UNWRAP_WETH into the router, then a WRAP_ETH of all its ETH to the user, reads as WETH with no minimum", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                unwrapWeth(ADDRESS_THIS),
                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
            ),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
    });
    // The router reads the recipient from the last 20 bytes of its word,
    // here address(2), the router itself.
    test("an UNWRAP_WETH whose recipient cannot be read, then a WRAP_ETH of all the router's ETH to the user, reads as WETH with no minimum", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                withDirtyWord(unwrapWeth(ADDRESS_THIS), 0),
                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
            ),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(detail(result, "Min. received")).toBeUndefined();
        expect(detail(result, "Min. paid out")).toBeUndefined();
    });
    // The first UNWRAP_WETH may pay the router the swap's output as ETH, and
    // the WRAP_ETH to the user pays all of it out as WETH, so the last
    // UNWRAP_WETH finds none of it.
    test.each([
        {
            kind: "an UNWRAP_WETH whose recipient cannot be read, then a WRAP_ETH of all the router's ETH to the user",
            steps: [
                withDirtyWord(unwrapWeth(ADDRESS_THIS), 0),
                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
            ],
        },
        {
            kind: "an UNWRAP_WETH into the router, a WRAP_ETH of all its ETH to the user, then a WRAP_ETH of all its ETH into the router",
            steps: [
                unwrapWeth(ADDRESS_THIS),
                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
                wrapEth(ADDRESS_THIS, CONTRACT_BALANCE),
            ],
        },
    ])(
        "$kind, then an UNWRAP_WETH to the user, reads as WETH with no minimum",
        ({ steps }) => {
            const result = decode(
                execute(
                    swapToWeth(ADDRESS_THIS),
                    ...steps,
                    unwrapWeth(MSG_SENDER),
                ),
            );
            expect(result.name).toBe("Swap USDT → WETH");
            expect(detail(result, "Min. received")).toBeUndefined();
            expect(detail(result, "Min. paid out")).toBeUndefined();
        },
    );
    // A SWEEP of WETH pays out WETH, and ETH paid to a WETH contract pays the
    // router WETH for it. The decoder treats each as a step that may pay out
    // as WETH the swap's output, which the router holds as ETH.
    test.each([
        {
            kind: "a SWEEP of WETH to the user",
            step: sweep(WETH, MSG_SENDER),
        },
        {
            kind: "a SWEEP of its ETH to the WETH contract",
            step: sweep(ZERO, WETH),
        },
        {
            kind: "a TRANSFER of 0.5 ETH to the WETH contract",
            step: transfer(0x05, ZERO, WETH, ONE_WETH / 2n),
        },
        {
            kind: "a PAY_PORTION of all its ETH to the WETH contract",
            step: transfer(0x06, ZERO, WETH, 10000n),
        },
    ])(
        "an UNWRAP_WETH into the router, then $kind, reads as WETH with no minimum",
        ({ step }) => {
            const result = decode(
                execute(
                    swapToWeth(ADDRESS_THIS),
                    unwrapWeth(ADDRESS_THIS),
                    step,
                ),
            );
            expect(result.name).toBe("Swap USDT → WETH");
            expect(detail(result, "Min. received")).toBeUndefined();
            expect(detail(result, "Min. paid out")).toBeUndefined();
        },
    );
    // The user receives 0.5 WETH and the rest of the swap's output as ETH.
    test("an UNWRAP_WETH into the router, then a WRAP_ETH of 0.5 ETH to the user, reads as WETH with no minimum", () => {
        const result = decode(
            execute(
                swapToWeth(ADDRESS_THIS),
                unwrapWeth(ADDRESS_THIS),
                wrapEth(MSG_SENDER, ONE_WETH / 2n),
                sweep(ZERO, MSG_SENDER),
            ),
        );
        expect(result.name).toBe("Swap USDT → WETH");
        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
    });
    // The UNWRAP_WETH pays the user the swap's WETH as ETH; the WRAP_ETH wraps
    // the ETH an earlier V4 step paid the router.
    test("an UNWRAP_WETH to the user, then a WRAP_ETH of all the router's ETH to the user, reads as ETH", () => {
        const result = decode(
            execute(
                v4Swap(
                    SWAP_USDT_FOR_ETH,
                    SETTLE_USDT,
                    take(ZERO, ADDRESS_THIS),
                ),
                swapToWeth(ADDRESS_THIS),
                unwrapWeth(MSG_SENDER),
                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
            ),
        );
        expect(detail(result, "Token Out").value).toBe("ETH");
        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
    });
    // The first swap is for at least 0.5 WETH and the second for at least
    // 1 WETH. The second sets the output side again, so the first
    // UNWRAP_WETH into the router no longer bears on it.
    test.each([
        { kind: "a V3 swap step", step: swapToWeth(ADDRESS_THIS) },
        {
            kind: "a V4 step that TAKEs its WETH to the router",
            step: v4Swap(
                SWAP_USDT_FOR_WETH,
                SETTLE_USDT,
                take(WETH, ADDRESS_THIS),
            ),
        },
    ])(
        "a swap paying WETH to the router, an UNWRAP_WETH into the router, a SWEEP of its ETH to the user, then $kind and an UNWRAP_WETH to the user, reads as ETH with the second swap's minimum",
        ({ step }) => {
            const result = decode(
                execute(
                    v3SwapExactIn(
                        ADDRESS_THIS,
                        USDT_2000,
                        ONE_WETH / 2n,
                        USDT,
                        WETH,
                    ),
                    unwrapWeth(ADDRESS_THIS),
                    sweep(ZERO, MSG_SENDER),
                    step,
                    unwrapWeth(MSG_SENDER),
                ),
            );
            expect(result.name).toBe("Swap USDT → ETH");
            expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
        },
    );
 });
 // https://git.eeqj.de/sneak/AutistMask/issues/606: any token a step pays the
 // router stays there unless a later step pays out or spends all of it, not
 // only the swap's output. A V4 SETTLE can take more of the user's tokens than
@@ -795,6 +1338,10 @@ describe("any token left in the router is not received", () => {
                ),
            ),
            left: tokenLine(WETH, "WETH"),
            // The second swap action spends 1 USDC of what the first buys,
            // so the step states no minimum
            // (https://git.eeqj.de/sneak/AutistMask/issues/574).
            noMin: true,
        },
        {
            kind: "a WRAP_ETH of 1 ETH into the router, then a V4 SETTLE of OPEN_DELTA from the router before the swap, which the user settles",
@@ -895,15 +1442,24 @@ describe("any token left in the router is not received", () => {
            ),
            left: { label: "Token moved into the router", value: "ETH" },
        },
-    ])("$kind", ({ data, left, spent, unread }) => {
+    ])("$kind", ({ data, left, spent, unread, noMin }) => {
        const result = decode(data);
        expect(labels(result)).toEqual([
            "Protocol",
            "Token In",
            // A later step whose SETTLE or SETTLE_ALL the decoder cannot read
            // may take anything from the sender: one line says so, in place
-            // of the Amount line (https://git.eeqj.de/sneak/AutistMask/issues/625).
+            // of the Amount line (https://git.eeqj.de/sneak/AutistMask/issues/625),
-            unread ? "Moved from the sender" : "Amount",
+            // after the lines the WRAP_ETH's 1 ETH then gets
            // (https://git.eeqj.de/sneak/AutistMask/issues/659).
            ...(unread
                ? [
                      "Moved from the sender",
                      "Token moved",
                      "Moved to",
                      "Moved from the sender",
                  ]
                : ["Amount"]),
            // A later swap step the user pays for spends `spent` of a token
            // other than Token In.
            ...(spent
@@ -912,7 +1468,7 @@ describe("any token left in the router is not received", () => {
            "Token Out",
            "Paid to",
            "Token moved into the router",
-            "Min. paid out",
+            ...(noMin ? [] : ["Min. paid out"]),
            "Steps",
            "Deadline",
        ]);
@@ -920,13 +1476,17 @@ describe("any token left in the router is not received", () => {
            expect(detail(result, "Moved from the sender").value).toBe(spent);
        }
        if (unread) {
-            expect(detail(result, "Moved from the sender").value).toBe(
+            expect(
-                UNDECODED,
+                result.details
-            );
+                    .filter((d) => d.label === "Moved from the sender")
                    .map((d) => d.value),
            ).toEqual(["1.0000 ETH", UNDECODED]);
        }
        expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
        expect(detail(result, "Token moved into the router")).toEqual(left);
-        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
+        expect(detail(result, "Min. paid out")?.value).toBe(
            noMin ? undefined : "1990.0000 USDC",
        );
    });
    // Uniswap's own routes: a swap paid in ETH wraps into the router what its
@@ -1534,15 +2094,6 @@ describe("a payout of part of the router's output", () => {
            ),
            min: "1.0000 WETH",
        },
        {
            kind: "PAY_PORTION of 25 bips, then UNWRAP_WETH",
            data: execute(
                swapToWeth(ADDRESS_THIS),
                transfer(0x06, WETH, OTHER, 25n),
                unwrapWeth(MSG_SENDER),
            ),
            min: "1.0000 ETH",
        },
        {
            kind: "V4 TAKE_PORTION of 25 bips, then TAKE_ALL",
            data: execute(
@@ -2263,26 +2814,37 @@ describe("the allow-revert flag", () => {
    });
    // Only the routers from UniversalRouterV2 on let a PERMIT2_PERMIT fail.
    // The permit's spender is the router at ROUTER, which on every other
    // router is an allowance to another spender, so the minimum reads
    // Min. paid out there.
    test.each([
-        { router: "UniversalRouterV1", address: ROUTER_V1, mark: "" },
+        {
            router: "UniversalRouterV1",
            address: ROUTER_V1,
            mark: "",
            minimum: "Min. paid out",
        },
        {
            router: "UniversalRouterV1_2_V2Support",
            address: ROUTER_V1_2,
            mark: "",
            minimum: "Min. paid out",
        },
        {
            router: "UniversalRouterV2",
            address: ROUTER,
            mark: " (allowed to fail)",
            minimum: "Min. received",
        },
        {
            router: "UniversalRouterV2_1_2",
            address: ROUTER_V2_1_2,
            mark: " (allowed to fail)",
            minimum: "Min. paid out",
        },
    ])(
-        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap reads as without the flag",
+        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap's lines read as without the flag",
-        ({ address, mark }) => {
+        ({ address, mark, minimum }) => {
            const steps = [
                permit2Permit(USDT, USDT_2000),
                swapToWeth(MSG_SENDER),
@@ -2296,10 +2858,25 @@ describe("the allow-revert flag", () => {
            expect(detail(withFlag, "Steps").value).toBe(
                "Permit2 Permit" + mark + " → V3 Swap (Exact In)",
            );
-            const withoutSteps = (r) =>
+            // The permit names the router at ROUTER as its spender, so its
-                r.details.filter((d) => d.label !== "Steps");
+            // amount stands as the Amount figure only there, and only without
-            expect(withoutSteps(withFlag)).toEqual(withoutSteps(plain));
+            // the flag. With the flag it stands on no router and gets lines
-            expect(detail(withFlag, "Min. received").value).toBe("1.0000 WETH");
+            // of its own, and the swap step names Token In: the same token,
            // its address written the same way.
            const permitLines = [
                "Permit2 allowance",
                "Allowance token",
                "Allowance spender",
            ];
            const swapLines = (r) =>
                r.details.filter(
                    (d) => !["Steps", ...permitLines].includes(d.label),
                );
            expect(swapLines(withFlag)).toEqual(swapLines(plain));
            expect(
                labels(withFlag).filter((l) => permitLines.includes(l)),
            ).toEqual(permitLines);
            expect(detail(withFlag, minimum).value).toBe("1.0000 WETH");
        },
    );
@@ -2885,6 +3462,7 @@ async function showDetail(data) {
    globalThis.window = { location: { search: "" } };
    state.networkId = "mainnet";
    state.blockscoutUrl = "https://explorer.example/api/v2";
    state.useBlockscout = true;
    state.viewData = {};
    state.viewStack = [];
    state.currentView = null;
@@ -7,6 +7,12 @@
 // only when the transaction is sent to a Universal Router deployment on the
 // network it is for; anywhere else it is left to the raw data.
 //
 // The transaction history labelled any call named `execute` or `multicall` a
 // Swap, whatever address it went to
 // (https://git.eeqj.de/sneak/AutistMask/issues/580). It now does so only for
 // such a call sent to a Universal Router deployment on the network the
 // transaction is on; any other is labelled by its method name.
 //
 // The transaction detail screen and the approval screen are driven against a
 // minimal DOM stub in the shape tests/tokenTransferDetail.test.js uses, the
 // approval screen opened the way tests/swapStatusAmount.test.js opens it.
@@ -28,11 +34,18 @@ jest.mock("../src/shared/log", () => ({
    isDebug: () => false,
 }));
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
        local: {
            get: async () => ({ autistmask: { useBlockscout: true } }),
            set: async () => {},
        },
    },
 };
 const { state } = require("../src/shared/state");
 const { fetchRecentTransactions } = require("../src/shared/transactions");
 const approval = require("../src/popup/views/approval");
 const { decodeCalldata } = approval;
 const transactionDetail = require("../src/popup/views/transactionDetail");
@@ -47,6 +60,8 @@ const SEPOLIA_ROUTER = "0x3a9d48ab9751398bbfa63ad67599bb04e4bdf98b";
 const ROUTER_ON_BOTH = "0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD";
 // The address with no code from the issue.
 const ORDINARY = "0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A";
 // A contract that is not a router, such as a multisig.
 const OTHER_CONTRACT = "0x5afe000000000000000000000000000000005afe";
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const SEPOLIA_WETH = "0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14";
@@ -129,8 +144,13 @@ describe("execute() calldata on the approval screen's decoder", () => {
 // The transaction the explorer reports: SWAP_DATA, sent to `mockSentTo`.
 const TX_HASH = "0x" + "5".repeat(64);
 let mockSentTo = null;
 // The transactions the explorer reports for RECIPIENT's history.
 let mockHistory = [];
 function mockExplorerAnswer(url) {
    if (url.endsWith("/addresses/" + RECIPIENT + "/transactions")) {
        return { items: mockHistory };
    }
    if (url.endsWith("/transactions/" + TX_HASH)) {
        return {
            to: { hash: mockSentTo },
@@ -187,33 +207,43 @@ function node(id) {
 }
 // Open the transaction detail screen with `activeNetworkId` active, for the
-// Sepolia transaction the explorer reports sent to `sentTo`, and wait for its
+// history row `row`, and wait for its decoded details.
-// decoded details.
+async function showDetail(row, activeNetworkId) {
-async function showDetailSentTo(sentTo, activeNetworkId) {
+    mockSentTo = row.to;
    mockSentTo = sentTo;
    globalThis.document = makeDocument();
    globalThis.window = { location: { search: "" } };
    state.networkId = activeNetworkId;
    state.blockscoutUrl = "https://explorer.example/api/v2";
    state.useBlockscout = true;
    state.viewData = {};
    state.viewStack = [];
    state.currentView = null;
-    transactionDetail.show({
+    transactionDetail.show(row);
        hash: TX_HASH,
        from: RECIPIENT,
        to: sentTo,
        value: "",
        symbol: "SepoliaETH",
        timestamp: 1790000000,
        isError: false,
        direction: "contract",
        directionLabel: "Swap",
        method: "execute",
        chainId: SEPOLIA,
    });
    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 // Open the transaction detail screen with `activeNetworkId` active, for the
 // Sepolia transaction the explorer reports sent to `sentTo`, and wait for its
 // decoded details.
 async function showDetailSentTo(sentTo, activeNetworkId) {
    await showDetail(
        {
            hash: TX_HASH,
            from: RECIPIENT,
            to: sentTo,
            value: "",
            symbol: "SepoliaETH",
            timestamp: 1790000000,
            isError: false,
            direction: "contract",
            directionLabel: "Swap",
            method: "execute",
            chainId: SEPOLIA,
        },
        activeNetworkId,
    );
 }
 describe("execute() calldata on the transaction detail screen", () => {
    test("sent to a router on the active network, it is a swap", async () => {
        await showDetailSentTo(SEPOLIA_ROUTER, "sepolia");
@@ -245,6 +275,58 @@ describe("execute() calldata on the transaction detail screen", () => {
    });
 });
 // The history row made from the explorer's answer for RECIPIENT's `method`
 // call sent to the contract `sentTo` on the network with `chainId`. The
 // explorer gives the address in checksummed form.
 async function historyRow(method, sentTo, chainId) {
    mockHistory = [
        {
            hash: TX_HASH,
            block_number: 7000000,
            timestamp: "2026-09-01T00:00:00Z",
            from: { hash: RECIPIENT },
            to: { hash: getAddress(sentTo), is_contract: true },
            value: "0",
            method,
            status: "ok",
        },
    ];
    const rows = await fetchRecentTransactions(
        RECIPIENT,
        "https://explorer.example/api/v2",
        chainId,
    );
    return rows[0];
 }
 // The history row's label and TransactionDetail's Type line, for a Sepolia
 // transaction. The active network does not decide either.
 describe.each([
    ["execute", "Execute"],
    ["multicall", "Multicall"],
 ])("a %s() call in the history", (method, methodLabel) => {
    test("sent to a router on its network, it is a Swap", async () => {
        const row = await historyRow(method, SEPOLIA_ROUTER, SEPOLIA);
        expect(row.directionLabel).toBe("Swap");
        await showDetail(row, "mainnet");
        expect(node("tx-detail-type").textContent).toBe("Swap");
    });
    test("sent to another contract, it is labelled by its method name", async () => {
        const row = await historyRow(method, OTHER_CONTRACT, SEPOLIA);
        expect(row.directionLabel).toBe(methodLabel);
        await showDetail(row, "sepolia");
        expect(node("tx-detail-type").textContent).toBe("Contract Call");
    });
    test("sent to a router of the other network only, it is labelled by its method name", async () => {
        const row = await historyRow(method, MAINNET_ROUTER, SEPOLIA);
        expect(row.directionLabel).toBe(methodLabel);
        await showDetail(row, "mainnet");
        expect(node("tx-detail-type").textContent).toBe("Contract Call");
    });
 });
 // Open the approval screen with Ethereum Mainnet active, for a site's Sepolia
 // transaction that sends SWAP_DATA to `sentTo`.
 async function showApprovalSentTo(sentTo) {
@@ -90,6 +90,9 @@ function swapDetail(data, label) {
 beforeEach(() => {
    state.trackedTokens = [];
    state.wallets = [];
    // The approval screen reads the explorer's report only while "Use
    // Blockscout" is on.
    state.useBlockscout = true;
 });
 describe("a swap of a token outside the bundled list", () => {
@@ -72,8 +72,12 @@ global.fetch = jest.fn(() => {
    throw new Error("tests must not perform network requests");
 });
 // Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
    runtime: { sendMessage() {} },
 };
 // A stub DOM. Every id in index.html that these two views touch resolves to a
 // fresh recording element; nothing here depends on layout, only on what the
@@ -120,7 +124,7 @@ global.document = {
    body: { prepend() {}, appendChild() {} },
    addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 const { AbiCoder, parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");
@@ -268,6 +272,9 @@ beforeEach(() => {
    state.fraudContracts = [];
    state.hideLowHolderTokens = false;
    state.currentView = null;
    // The screens save this page's copy of "Use Blockscout" over the stored
    // one. So the page's copy is turned on here too.
    state.useBlockscout = true;
 });
 describe("the Send screen resolves the scale rather than reading the stored one", () => {
Author	SHA1	Message	Date
sneak	500fe75101	fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668 ) check / check (push) Waiting to run Details e2e / e2e-chrome (push) Waiting to run Details e2e / e2e-firefox (push) Waiting to run Details Out of the box the wallet sent the user's addresses to Blockscout and each recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on Etherscan", now gate those requests. Both are off in a new install and offered unticked on Welcome and in Settings. While one is off, the screens that relied on it say so in a plain line. Each gated request reads its setting from storage before it asks and when the answer lands, and drops a late answer. An open popup takes another page's change and draws its screens again. While "Use Blockscout" is off, no address keeps an untracked token, and no screen names a token from Blockscout's report. ENS lookups ask only the RPC endpoint. Model: opus-5-5 (implementation); fable-5-1 (prose)	2026-10-26 16:30:00 +00:00
clawbot	c316d9ee78	fix: tracked tokens' balances are read through the RPC endpoint (closes #669 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details refreshBalances() now reads the balance of every token tracked on the active network, at every address, with balanceOf through the same provider as the ETH balance. The entry takes its holder count and decimals from Blockscout's entry for the token in the same refresh, or keeps them from before while Blockscout fails. A failed balanceOf keeps the token's previous entry, or takes Blockscout's entry when there is none, and is logged. Blockscout's answer still adds the tokens the user has not tracked, as before. The browser test for a hostile symbol now untracks the stub token first, because a tracked token is listed under the symbol it was added with. Model: opus-5-5	2026-10-21 14:16:26 +02:00
clawbot	b9bb1569fd	fix: a V4 step that spends some of its output currency shows no Min. received (closes #574 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details A V4 step's Min. received was the sum of the minimums of the swap actions that buy its output currency, even when another swap action in the same step spends some of that currency. The user then receives less than that figure. decodeV4Swap() now gives no minimum when a swap action in the step also spends the output currency, as it already does for other minimums it cannot state. A multi-hop action counts only the currency it spends and the one it ends with, so a path through an intermediate currency is not read as spending it. Model: opus-5-5	2026-10-21 07:34:26 +02:00
clawbot	4be625dc06	fix: an allowance to another spender leaves no Amount figure for its token and no Min. received (closes #658 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details Code that a step runs, such as a V4 pool's hook, can call a spender other than the router, which can then take up to its allowance from the user's wallet before the transaction ends. The Amount figure and Min. received took no account of it. In decode(), an allowance of Token In to a spender other than the router now leaves no Amount line, as an unread permit already did, so the swap steps' own takes get lines of their own. Any allowance to another spender, or a permit or batch the decoder cannot read, makes the minimum read Min. paid out. Permits to the router read as before. Model: opus-5-5	2026-10-21 06:24:51 +02:00
clawbot	e2965469ba	fix: with no Amount line, the user's takes the total adds up get lines of their own (closes #659 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details When a step this decoder cannot read, an unreadable permit, or a take of Token In with an unknown amount held back the Amount line, the amount the step that sets the input side states, and each later take of Token In added to it, appeared on no line, while other takes kept their own Moved from the sender lines. Those takes now get the same lines, first. The first step's amount gets them only when the user pays that step (a V2 or V3 step with payerIsUser true, a V4 step the user pays some of its input token, or a WRAP_ETH): one paid from the router takes nothing from the wallet. Routes with an Amount line read as before. Model: opus-5-5	2026-10-21 05:15:21 +02:00
clawbot	2691702f80	fix: an open popup follows a network switch the background saves (closes #650 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details When the background saves a network switch after the user approves a site's request, or another popup page saves one, an open popup takes the new network from the stored record inside a save, holding the lock, and checks the record once at start-up for a switch saved before it listened. The network it takes is not counted as the popup's own change, even when that save fails to write. It then leaves the page as a switch in Settings does. A switch in Settings is now made inside its own save too, so one picked while a follow waits for the lock is made after it. The popup never switches the network itself. Model: opus-5-5	2026-10-21 04:26:51 +02:00
clawbot	5f2b606754	fix: a PERMIT2_TRANSFER_FROM before a permit keeps its amount from standing as the Amount figure (closes #655 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details A PERMIT2_TRANSFER_FROM that runs before a PERMIT2_PERMIT of the same token moves it under whatever allowance the router already had, so it can move more than the permit's amount. The permit's amount still stood as the Amount figure, which could then read lower than what leaves the wallet. decode() now counts such a transfer, into the router or anywhere else, among the steps before the permit that took its token, so the permit no longer stands: the Amount line gives the total the steps take, as with no permit, and the permit gets its own lines. A transfer after the permit, or of another token before it, still lets it stand; tests cover both. README Transaction Decoding states the condition. Model: opus-5-5	2026-10-21 03:16:51 +02:00
clawbot	f53b503b15	fix: a PERMIT2_PERMIT_BATCH, and a permit that cannot be read, state what they allow (closes #652 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details A PERMIT2_PERMIT_BATCH was never read, and a PERMIT2_PERMIT whose input could not be read got no lines, so the approval screen showed nothing of the allowances either grants. Each allowance of a batch now gets the three lines a permit whose amount does not stand gets: Permit2 allowance, Allowance token and Allowance spender. A permit or batch that cannot be read gets one Permit2 allowance line reading Unknown (could not be decoded) and leaves no Amount line. Any batch in the transaction keeps a PERMIT2_PERMIT's amount from standing. A batch pays nobody, so it no longer adds a Paid to line. README Transaction Decoding and the TxApproval element list match. Model: opus-5-5	2026-10-21 01:41:35 +02:00
clawbot	45aead6340	fix: only a permit whose amount is the Amount figure names Token In (closes #370 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details A PERMIT2_PERMIT named Token In whether or not its amount stood as the Amount figure, so the approval screen could show a permit's token, or an allowance, where the swap's own input belonged. Now only a permit whose amount stands names Token In. Every other permit, before the swap steps or after them, leaves Token In and Amount as they read with no permit and gets three lines of its own: Permit2 allowance, Allowance token and Allowance spender. A V3 swap step's tokens are checksummed, as every other decoded address is, so a token's address reads the same on every line. README Transaction Decoding, its unknown token scale passage and the TxApproval element list match. Model: opus-5-5	2026-10-21 00:56:41 +02:00
clawbot	e517219038	fix: a balance refresh that returns after a network switch writes nothing (closes #577 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details The popup's doRefreshAndRender() and the background's backgroundRefresh() each note the network a refresh starts on and write its balances only if that network is still the active one when the requests return. Otherwise nothing is written and lastBalanceRefresh stays as the switch left it. The background checks inside updateState(). The popup refreshes a copy of its wallets and copies the results onto `state` from inside its save, under the lock, only if both its own network and the stored record's still match, so a switch the background makes is caught too. saveState() takes an optional function, run there on the stored record before the page's state is compared, that may change `state` or return false to cancel the write. Model: opus-5-5	2026-10-20 22:59:51 +02:00
clawbot	a3da448f0d	fix: a swap's WETH minimum reads as ETH only when all its WETH reaches the UNWRAP_WETH (closes #642 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details Between the step that set the output side and the UNWRAP_WETH, only a step the decoder read that is a PERMIT2_PERMIT, a BALANCE_CHECK_ERC20, or a SWEEP, TRANSFER, PAY_PORTION or PAY_PORTION_FULL_PRECISION of a token other than WETH, and not of ETH to a WETH contract, keeps the swap's WETH minimum as an ETH minimum; any other step leaves ETH with no minimum. After an UNWRAP_WETH whose recipient is the router or cannot be read, any later step but those makes the swap read WETH with no minimum. Only a step that sets the output side again brings back ETH or a minimum. A WETH fee paid by PAY_PORTION before the UNWRAP_WETH now shows no minimum. README Display Consistency states the same rule. Model: opus-5-5	2026-10-20 21:40:50 +02:00
clawbot	93c34e1a2a	fix: a popup save no longer undoes a network switch the background saved during it (closes #641 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details The popup's saveState() and the background's updateState() each read the stored record, change it and write it back, each ordered only within its own context, so a write by one could land between the other's read and write and be lost. Both now hold the browser's lock (navigator.locks) from the read to the write, through withLock() in src/shared/browserApi.js, and the recovery screen's reset takes it too. A page in a Firefox private window gets locks of its own and is not covered. The lock also orders a page's own saves, so both per-context queues are gone. The unit tests get a small lock from a Jest setup file. Model: opus-5-5	2026-10-20 20:13:19 +02:00
clawbot	4472746b89	fix: history calls an execute or multicall a Swap only when sent to a router (closes #580 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details The history labelled any call named execute or multicall a Swap, whatever contract it went to, so a multisig or smart account call showed as a Swap in the list and on TransactionDetail's Type line. Such a call is now a Swap only when sent to a Universal Router address listed for the network the transaction is on, the list the approval screen uses (routerRelease(), now exported from uniswap.js). Any other is labelled by its method name and its Type line reads Contract Call. The named router swap methods keep their label. Model: opus-5-5	2026-10-20 17:19:42 +02:00
clawbot	4109c4d44a	fix: WETH paid to the user before an UNWRAP_WETH reads as WETH (closes #607 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details An UNWRAP_WETH made Token Out ETH whenever the output side was WETH, though the router unwraps only the WETH it holds. decode() now records where the step that set the output side paid its output, and an UNWRAP_WETH makes the output ETH only when that step paid WETH to the router and the router still holds WETH. When that step paid only part of its WETH to the router, or made a payout the decoder cannot read, the output reads ETH with no minimum: the decoder does not count how much of that step's minimum reaches the router, nor read the UNWRAP_WETH's own minimum. A BALANCE_CHECK_ERC20 pays nobody, so it is never read as unwrapped. README Display Consistency says the same. Model: opus-5-5	2026-10-20 16:09:45 +02:00
clawbot	7b9821b06f	fix: the Chrome layout tests and popup comments use the popup's real 396x600 size (closes #556 ) check / check (push) Canceled after 0s Details e2e / e2e-chrome (push) Canceled after 0s Details e2e / e2e-firefox (push) Canceled after 0s Details POPUP_VIEWPORT in tests/e2e/run.js said 360x600, while body in src/popup/styles/main.css is 396px wide and the background opens an approval window at 396x600. It is now 396x600, defined once near the top of the file, and the hostile token symbol's frame takes its size from it. assertAddressesFit() now measures the page at that size, then puts back the size it found. Every page it measured, the popup's own screens and the two approval prompts, was 1280x720, where a page never scrolls sideways, so its sideways-scroll check could not fail. README's list of what the Chrome suite leaves out says what sizing the page does not cover. Comments in src/popup/index.html and tests/dustThreshold.test.js that said 360x600 now say 396x600. Model: opus-5-5	2026-10-20 16:02:09 +02:00