test: assert the #150 and #151 items the harness did not cover (closes #188)

The suite asserted that the two screens those issues broke now open
without throwing, which is narrower than their definition of done. The
four remaining items are asserted here, additively; nothing existing was
restructured.

Back navigation out of Add Token is checked against the persisted
navigation stack, read from extension storage, as a delta: the round trip
Home -> AddressDetail -> AddToken -> Back -> Back must leave the stack
exactly as it found it. A stale entry is invisible on screen until the
user presses Back one time too many, which is precisely the second-order
damage of #150, so the stack rather than the visible view is what gets
asserted. Stating it as a delta keeps it independent of whatever depth
earlier tests leave behind.

The quick-pick test clicks a button and requires the address field to
hold that button's contract address; the old assertion only counted the
buttons rendered.

The native ETH detail path needed a fixture: the normal-transactions
endpoint answered with an empty list unconditionally, so there was no
non-ERC-20 row to open at all. seedNativeTransfer serves one, and the
detail screen must show the native type, the value, the raw wei quantity
and no token contract row - the row whose branch is where a regression of
the non-ERC-20 case would land.

Tap-to-copy reads the real clipboard back rather than watching the
handler run, after seeding a sentinel so an untouched clipboard cannot
pass. Clipboard permissions are granted context-wide because an
origin-scoped grant is refused for chrome-extension: URLs.

Each of the four was demonstrated failing against a deliberately broken
build; the captured output is in the pull request.

README.md

@@ -185,17 +185,14 @@ to the background — with the message that would carry it required to be presen
 so that check cannot pass by observing nothing. That last one is the standing
 floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
-Three limits of that coverage, none of them papered over. The RPC is stubbed
+Two limits of that coverage, neither of them papered over. The RPC is stubbed
 throughout, so this is **not** a real dApp against a real network with real
 funds; that remains a human pass before 1.0.0. The site-connection prompt is
 raised through `chrome.action.openPopup()`, and headless Chromium's
 browser-action popup is not a page Playwright can see or click, so that one
 prompt is driven at the URL the extension itself puts on the action — the same
 page and the same approval id, but whether a real toolbar click shows it is not
-observable here. And the EIP-1193 error code does not survive the last hop: the
+observable here.
-rejection that crosses the boundary carries code 4001 and is asserted to, but
-`src/content/inpage.js` rebuilds it as `new Error(message)`, so the calling page
-catches an error with no `code` property.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration

TODO.md

@@ -45,6 +45,15 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
+  have. The End-to-End Tests section listed the EIP-1193 code being dropped in
+  the last hop into the page as a standing limit of the dApp coverage; that
+  stopped being true when
+  [#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
+  touch the README. The paragraph is deleted and the two remaining limits — the
+  stubbed RPC and the unobservable toolbar popup — were checked against the
+  current `src/content/inpage.js` and `tests/e2e/` and left as they are
+  ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
 - 2026-08-14: The parts of the
   [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
   [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the