docs: code comments name the headings README has now (closes #724)

The README rewrite renamed or merged several headings that comments still
cited. Each comment now names the current heading. Line number citations of
README become headings too, and one test name drops its line numbers.

The e2e workflow's citations of "In CI" are dropped, because no section has what
they pointed at. Its comment also corrects what it says about required jobs and
open reports.

The comment on withLock() no longer states a Firefox private window exception,
because the manifest keeps the extension out of those windows.

Two comments also take corrections from reviews: the cases with no total in
DeleteAddress's warning, and the screens that say a swap's amount could not be
decoded.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -19,12 +19,10 @@ on: [push]
 # by the host daemon and mounts an empty directory, and the runner image's
 # node is too old to install this repo's dependencies.
 #
-# These jobs REPORT, they do not gate. Whether a check blocks a merge is
-# Gitea branch protection, which this repo does not configure, so a failure
-# here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked while reports of the
-# Chrome suite failing under load are still open. A gate that fails at random
-# teaches people to merge past red.
+# These jobs REPORT, they do not gate. No branch requires these two jobs, so
+# a failure is a red mark a reviewer has to account for. The Chrome suite has
+# failed under load before, and no such report is open. A gate that fails at
+# random teaches people to merge past red.
 #
 # Nothing here may pass vacuously. There is no continue-on-error and no
 # `|| true`. Both scripts exit non-zero when docker is missing, when the

tests/e2e/run.js

@@ -5770,8 +5770,8 @@ async function main() {
     // There is no fourth: once the context is closed nothing can record,
     // because the route handler and the console listeners died with it.
     // Traffic that a test defers past the trailing drain is therefore
-    // never observed at all — a real limit of this design, stated in the
-    // README, and not one any post-teardown hook could close.
+    // never observed at all — a real limit of this design, and not one
+    // any post-teardown hook could close.
     //
     // Two green-but-vacuous runs on this harness were the same shape: a
     // record falling outside somebody's window and being dropped. First

tests/transactions.test.js

@@ -1,7 +1,7 @@
 // Tests for the address-poisoning defense in src/shared/transactions.js.
 //
-// README.md:730-814 describes four filters as a core security property of
-// the wallet: known token symbol verification, the low-holder threshold, the
+// README, Scam protection, describes four filters as a core security property
+// of the wallet: known token symbol verification, the low-holder threshold, the
 // fraud contract blocklist, and the dust threshold.  A regression in any of
 // them does not crash — it silently stops filtering, and poisoned look-alike
 // addresses reappear in the user's transaction history.  These tests pin the
@@ -46,11 +46,12 @@ const { debugFetch } = require("../src/shared/log");
 const { state } = require("../src/shared/state");
 
 // ---------------------------------------------------------------------------
-// Addresses and hashes from the two attacks documented in README.md:730-814.
+// Addresses and hashes from two real attacks. README, Scam protection, has the
+// filters that stop them.
 // ---------------------------------------------------------------------------
 
-// The fake "Ethereum" token with symbol "ETH" and zero holders
-// (README.md:735-750).
+// The fake "Ethereum" token with symbol "ETH" and zero holders. See "Known
+// symbol spoofing" and "Low-holder tokens" in README, Scam protection.
 const FAKE_ETH_CONTRACT = "0xd05339f9ea5ab9d9f03b9d57f671d2abd1f55c82";
 // The fraudulent Transfer event it emitted.
 const FAKE_ETH_TRANSFER_HASH =
@@ -62,7 +63,8 @@ const LEGIT_RECIPIENT = "0xc3c693ae04bad5f13c45885c1e85a9557798f37e";
 // The scam address the fake token transfer pointed at ("0xC3C0" vs "0xC3c6").
 const TOKEN_SCAM_LOOKALIKE = "0xc3c0aea127c575b9ffd03bf11c6a878e8979c37f";
 
-// The second wave: a real 1 gwei native transfer (README.md:800-808).
+// The second wave: a real 1 gwei native transfer. See "Dust transactions" in
+// README, Scam protection.
 const DUST_TX_HASH =
     "0x2708ebddfb9b5fa3f7a89d3ea398ef9fd8771b83ed861ecb7c21cd55d18edc74";
 const DUST_SENDER_LOOKALIKE = "0xc3c6b3b4402bd78a9582ab6b00e747769344f37e";
@@ -79,7 +81,7 @@ const NOVEL_SPAM_SYMBOL = "SPAMTKN";
 // An ordinary counterparty for legitimate-transaction fixtures.
 const ORDINARY_PEER = "0x5aa0f9f1e0a1d0e0e5c1e7ce3b7dbbe9c19f0a11";
 
-// The documented default settings (README.md:810-814, state.js:24-27).
+// The documented default settings (README, Settings; state.js:24-27).
 const DEFAULT_FILTERS = {
     hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
@@ -220,7 +222,7 @@ describe("token list assumptions the fixtures rely on", () => {
     });
 });
 
-describe("the real attacks documented in README.md:730-814", () => {
+describe("the real attacks", () => {
     test('the fake "Ethereum"/"ETH" token transfer is filtered by default', () => {
         const attack = fakeEthTokenTransfer();
         const result = filterTransactions([attack], filters());