fix: a shared ticker no longer hides one of its two real tokens (closes #276 )

KNOWN_SYMBOLS maps a symbol to the set of contract addresses that bear it, instead of to one of them. A ticker is not unique, and the bundled list proves it: seven of its 512 tokens -- FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC -- share a symbol with another bundled entry at a different real contract. The table is built from that list first-wins, so it kept the earlier entry of each pair and the later one was judged a spoof of its own symbol at its own address. A user holding any of the seven saw it filtered out of the balance list, the transaction history and the send token selector, and so could not spend it through the UI. Both contracts of every pair come from the same source fetch (CoinGecko, 2026-02-27, decimals verified on-chain), so neither is stale relative to the other and there is nothing to prefer between them. The fix is therefore in the shape of the table rather than in its contents: no address was picked and none was dropped. isSpoofedSymbol() asks set membership where it asked equality, which does not loosen the rule -- every address in a set is one the wallet ships as a real token, and a contract outside the set is still a spoof. The native-asset entry stays null and still means no contract may bear the symbol. The suite walked KNOWN_SYMBOLS, which is derived from TOKENS, so it could only assert that the table agreed with itself. It now also walks TOKENS asserting that no bundled token is filtered at its own address -- the walk that would have caught this -- pins both contracts of each of the seven by address, asserts a third contract bearing a shared ticker is still filtered, and asserts every address the table vouches for is a bundled token reporting that symbol.
2026-08-12 11:29:40 +00:00
10 changed files with 124 additions and 1470 deletions
--- a/README.md
+++ b/README.md
@@ -638,21 +638,6 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 A reopened popup renders the wallet list and the one screen it restores onto,
 and nothing else, so every screen on the stack behind that one is still the
 blank template from `index.html`. "Back" therefore renders its target rather
 than only unhiding it, through the same dispatch and data guards as the restore
 (`src/popup/viewRouter.js`), and falls back to Home when the state the target
 would render is gone.
 It renders only a screen this page load has not rendered yet. Forward navigation
 renders as it goes, and `viewRouter.js` records every screen that reaches
 `showView()`, so "Back" onto a screen already on the page unhides it and nothing
 more — rendering it a second time would re-fetch and overwrite what it holds,
 such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret
--- a/TODO.md
+++ b/TODO.md
@@ -45,53 +45,6 @@ undefined identifiers, which is how
 # Completed Steps
 - 2026-08-14: The parts of the
  [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
  [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
  e2e suite did not cover are asserted. It had only shown that the two screens
  open without throwing. Now: the Add Token round trip leaves the navigation
  stack exactly as it found it, read out of extension storage rather than
  inferred from which screen is up, so an orphaned entry — the second-order
  damage of #150 — is caught where it happens rather than one Back press later;
  a common-token quick-pick puts its contract address in the field; the native
  ETH detail path renders with its own type, value and raw quantity and with the
  token contract row still hidden, against a new `seedNativeTransfer` fixture,
  since the normal-transactions endpoint answered `[]` unconditionally and there
  was no non-ERC-20 row to open; and tapping the token contract address puts it
  on the real clipboard, read back after a sentinel write. Each of the four was
  demonstrated failing against a deliberately broken build
  ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
  rebuilt every failure as `new Error(error.message)`, so the code the
  background produced and the content script relayed intact was dropped in the
  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
  the user deliberately declined was indistinguishable from one that broke. The
  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
  boundary sent one, `data`, passed through verbatim rather than matched against
  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
  here. An error the background sent with no code stays a plain `Error` with no
  `code` property, and `message` is unchanged in every case. All four request
  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
  now requires it on the page's Error as well as on the wire, for all four
  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
  it. A reopened popup renders the wallet list and the one screen it restores
  onto, so every screen further down the stack was still the blank template from
  `index.html`, and Back walked straight onto it — an empty address, no
  balances, no QR code. The Back path now goes through the same per-view
  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
  with `restoreView()`), falling back to Home when the state the target would
  render is gone. It renders only a view this page load has not rendered yet:
  `viewRouter.js` records every view that reaches `showView()`, which is where
  forward navigation and the restore both end, so Back onto a view already on
  the page unhides it and nothing more. That is what keeps a second render from
  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
  a transaction list already loaded. Home is the exception and is always
  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
  and by three end-to-end cases against the real popup, each demonstrated
  failing on the unfixed build
  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
  that bear it, not to one of them. A ticker is not unique: seven of the 512
  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
--- a/src/content/inpage.js
+++ b/src/content/inpage.js
@@ -11,39 +11,6 @@
    let nextId = 1;
    const pending = {};
    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
    // rather than properties bolted onto an Error because this object crosses
    // no boundary after construction — it is built in the page's own realm and
    // handed straight to the caller's catch — so the prototype survives and
    // `error.name` is a stable thing for a dApp to see.
    class ProviderRpcError extends Error {
        constructor(code, message, data) {
            super(message);
            this.name = "ProviderRpcError";
            this.code = code;
            if (data !== undefined) this.data = data;
        }
    }
    // Rebuild a boundary error as the error the page catches, carrying the
    // code (and data) the extension reported. Without this a dApp cannot tell
    // a user's refusal (4001) from a wallet that broke, and retries or shows
    // an error instead of accepting the refusal.
    //
    // Whatever code arrived is passed through verbatim rather than being
    // matched against a list: the extension emits 4001, 4100 and 4902 today,
    // and a code this file has never heard of is still the truth about what
    // happened. An error reported with no code at all stays a plain Error —
    // a ProviderRpcError whose `code` is undefined would advertise a
    // conformance it does not have. `message` is untouched in every case.
    function toPageError(error) {
        const message = (error && error.message) || "Request failed";
        if (error && error.code !== undefined && error.code !== null) {
            return new ProviderRpcError(error.code, message, error.data);
        }
        return new Error(message);
    }
    // Listen for responses from the content script
    window.addEventListener("message", function onUuid(event) {
        if (event.source !== window) return;
@@ -53,7 +20,7 @@
        if (!p) return;
        delete pending[id];
        if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
        } else {
            p.resolve(result);
        }
--- a/src/popup/index.js
+++ b/src/popup/index.js
@@ -9,17 +9,16 @@ const {
    $,
    showView,
    updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Renders a view the popup lands on without having navigated to it forward:
+// Views that can be fully re-rendered from persisted state. All others fall
-// on restore here, and on Back. Only the views that can be fully re-rendered
+// back to the nearest restorable parent; see the module for why the
-// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
+// secret-bearing views are absent.
-// through it; anything else falls back to the nearest restorable parent.
+const { RESTORABLE_VIEWS } = require("./restorableViews");
 const { renderView, makeBackRenderer } = require("./viewRouter");
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -109,22 +108,91 @@ const ctx = {
    },
 };
-// The view modules the router renders through, keyed as it expects them.
+function needsAddress(view) {
-const viewModules = {
+    return (
-    main: { show: () => fallbackView() },
+        view === "address" ||
-    addressDetail,
+        view === "address-token" ||
-    addressToken,
+        view === "receive" ||
-    receive,
+        view === "transaction"
-    settings,
+    );
-    settingsAddToken,
+}
-    confirmTx,
+
-    transactionDetail,
+function hasValidAddress() {
-    txStatus,
+    return (
-};
+        state.selectedWallet !== null &&
        state.selectedAddress !== null &&
        state.wallets[state.selectedWallet] &&
        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
    );
 }
 function restoreView() {
-    if (!renderView(state.currentView, state, viewModules)) {
+    const view = state.currentView;
-        fallbackView();
+    if (!view || !RESTORABLE_VIEWS.has(view)) {
        return fallbackView();
    }
    if (needsAddress(view) && !hasValidAddress()) {
        return fallbackView();
    }
    if (view === "address-token" && !state.selectedToken) {
        return fallbackView();
    }
    switch (view) {
        case "address":
            addressDetail.show();
            break;
        case "address-token":
            addressToken.show();
            break;
        case "receive":
            receive.show();
            break;
        case "settings":
            settings.show();
            break;
        case "settings-addtoken":
            settingsAddToken.show();
            break;
        case "confirm-tx":
            if (state.viewData && state.viewData.pendingTx) {
                confirmTx.restore();
            } else {
                fallbackView();
            }
            break;
        case "transaction":
            if (state.viewData && state.viewData.tx) {
                transactionDetail.render();
            } else {
                fallbackView();
            }
            break;
        case "wait-tx":
            // Resumes the receipt poll from the persisted broadcast time.
            if (!txStatus.restoreWait()) {
                fallbackView();
            }
            break;
        case "success-tx":
            if (state.viewData && state.viewData.hash) {
                txStatus.renderSuccess();
            } else {
                fallbackView();
            }
            break;
        case "error-tx":
            if (state.viewData && state.viewData.message) {
                txStatus.renderError();
            } else {
                fallbackView();
            }
            break;
        default:
            fallbackView();
            break;
    }
 }
@@ -179,7 +247,7 @@ async function init() {
        settings.show();
    });
-    setBackRenderer(makeBackRenderer(state, viewModules));
+    setRenderMain(renderWalletList);
    welcome.init(ctx);
    addWallet.init(ctx);
--- a/src/popup/viewRouter.js
+++ b/src/popup/viewRouter.js
@@ -1,167 +0,0 @@
 // Rendering a view the popup lands on without having navigated to it
 // forward: on restore, and on Back. In both cases the view may never have
 // been rendered in this page load — a reopened popup renders only the
 // wallet list and the view it restores onto, so every other view is still
 // the blank static template from index.html — so unhiding it is not enough.
 //
 // Forward navigation renders as it goes and must NOT come through here:
 // rendering a second time would re-fetch and clobber whatever the view has
 // in flight.
 //
 // The view modules are injected and nothing here touches the DOM, so the
 // dispatch and its data guards can be tested directly; src/popup/index.js
 // cannot be required outside a browser.
 const { RESTORABLE_VIEWS } = require("./restorableViews");
 // The views this page load has rendered.
 //
 // The Back path cannot otherwise tell its two cases apart. A view the popup
 // never rendered is still the blank template from index.html and has to be
 // rendered; a view already on the page must NOT be rendered again, because
 // a second render re-fetches and overwrites whatever the user has typed
 // into it and not yet saved.
 //
 // Registration is showView() in views/helpers.js, which is the last thing
 // every render path runs — restoreView()'s, the Back path's, and every
 // forward show(). That is the point of putting it there rather than in the
 // individual views: a view added later registers itself with no one having
 // to remember it, so this cannot decay.
 //
 // Module scope is page-load scope: the popup loads this module once per
 // page load, and a reopened popup gets a fresh, empty set — which is
 // exactly the state that makes the Back path render.
 const renderedViews = new Set();
 function markViewRendered(view) {
    if (view) renderedViews.add(view);
 }
 // Begin a fresh page-load scope. The popup gets one by being loaded; the
 // unit tests, which simulate several page loads against one module
 // instance, ask for one.
 function resetRenderedViews() {
    renderedViews.clear();
 }
 // Home is the exception: Back re-renders it every time, which is what the
 // popup did before this router existed (index.js registered
 // renderWalletList() as setRenderMain(), and goBack() called it on every
 // Back onto "main"). It must stay that way — the wallet list has to reflect
 // what changed while the user was away from it, such as a wallet renamed or
 // an address removed in Settings — and Home holds no unsaved input to lose.
 const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
 // Views that render an address the user picked and cannot be rendered
 // without one.
 const ADDRESS_VIEWS = new Set([
    "address",
    "address-token",
    "receive",
    "transaction",
 ]);
 function needsAddress(view) {
    return ADDRESS_VIEWS.has(view);
 }
 function hasValidAddress(state) {
    return Boolean(
        state.selectedWallet !== null &&
        state.selectedAddress !== null &&
        state.wallets[state.selectedWallet] &&
        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
    );
 }
 // Render `view` from persisted state. Each view module shows itself, so a
 // true return means the view is both rendered and on screen.
 //
 // Returns false when the view is not one the popup renders from state, or
 // when the state it would render is gone — a token no longer selected, a
 // transaction no longer persisted. The caller falls back rather than
 // putting an empty template on screen.
 function renderView(view, state, views) {
    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
    if (needsAddress(view) && !hasValidAddress(state)) return false;
    if (view === "address-token" && !state.selectedToken) return false;
    const data = state.viewData || {};
    switch (view) {
        case "main":
            views.main.show();
            return true;
        case "address":
            views.addressDetail.show();
            return true;
        case "address-token":
            views.addressToken.show();
            return true;
        case "receive":
            views.receive.show();
            return true;
        case "settings":
            views.settings.show();
            return true;
        case "settings-addtoken":
            views.settingsAddToken.show();
            return true;
        case "confirm-tx":
            if (!data.pendingTx) return false;
            views.confirmTx.restore();
            return true;
        case "transaction":
            if (!data.tx) return false;
            views.transactionDetail.render();
            return true;
        case "wait-tx":
            // Resumes the receipt poll from the persisted broadcast time,
            // and answers false when there is nothing resumable left.
            return Boolean(views.txStatus.restoreWait());
        case "success-tx":
            if (!data.hash) return false;
            views.txStatus.renderSuccess();
            return true;
        case "error-tx":
            if (!data.message) return false;
            views.txStatus.renderError();
            return true;
        default:
            return false;
    }
 }
 // The Back-path renderer, registered with setBackRenderer() in
 // views/helpers.js.
 //
 // Returns false — leaving goBack() to unhide the view, as it always did —
 // in the two cases where the view is known to be on the page already:
 //
 //   - It is not one the popup renders from persisted state. The restored
 //     stack is filtered against RESTORABLE_VIEWS, so such a view can only
 //     be on the stack from this page load, where forward navigation
 //     rendered it on the way in.
 //   - This page load has rendered it. Re-rendering would re-fetch and
 //     clobber what it holds; Home is rendered anyway, see above.
 //
 // What is left is the case the router exists for: a view on the stack that
 // this page load has never rendered, whose template is still blank.
 function makeBackRenderer(state, views) {
    return function renderBack(view) {
        if (!RESTORABLE_VIEWS.has(view)) return false;
        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
            return false;
        }
        if (!renderView(view, state, views)) {
            views.main.show();
        }
        return true;
    };
 }
 module.exports = {
    renderView,
    makeBackRenderer,
    markViewRendered,
    resetRenderedViews,
 };
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -7,7 +7,6 @@ const {
    getAddressValueUsd,
 } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { markViewRendered } = require("../viewRouter");
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -77,10 +76,6 @@ function showView(name) {
    }
    clearFlash();
    state.currentView = name;
    // A view's show() ends here, so this is where the Back path learns the
    // view is no longer the blank template from index.html and must not be
    // rendered a second time. See viewRouter.js.
    markViewRendered(name);
    saveState();
    updateDebugBanner(name);
 }
@@ -116,19 +111,12 @@ function updateDebugBanner(viewName) {
    }
 }
-// Callback that renders a view being navigated BACK onto. Set once by
+// Callback to re-render the main/home view when navigating back to it.
-// index.js via setBackRenderer(), which routes the view through the same
+// Set once by index.js via setRenderMain().
-// per-view render and data guards restoreView() uses.
+let _renderMain = null;
 //
 // It answers true when it took the navigation — the view is rendered and
 // shown, or its backing data was gone and it fell back — and false for a
 // view the popup does not render from persisted state. Those can only be
 // on the stack from this page load, because the stack is filtered on load,
 // so they have already been rendered and only need unhiding.
 let _renderBack = null;
-function setBackRenderer(fn) {
+function setRenderMain(fn) {
-    _renderBack = fn;
+    _renderMain = fn;
 }
 // Push the current view onto the navigation stack so goBack() can
@@ -148,11 +136,9 @@ function goBack() {
    } else {
        target = "main";
    }
-    // A popped view is landed on, not navigated to. If the popup has been
+    if (target === "main" && _renderMain) {
-    // closed and reopened since the view was pushed, nothing has ever
+        _renderMain();
-    // rendered it in this page load and its template is still blank, so it
+    }
    // has to be rendered here rather than merely unhidden.
    if (_renderBack && _renderBack(target)) return;
    showView(target);
 }
@@ -484,7 +470,7 @@ module.exports = {
    showView,
    onViewLeave,
    updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
--- a/tests/backNavigation.test.js
+++ b/tests/backNavigation.test.js
@@ -1,329 +0,0 @@
 // Back after reopening the popup (#268).
 //
 // A reopened popup renders the wallet list and the one view it restores
 // onto; every other view is still the blank static template from
 // index.html. goBack() used to only unhide its target, so Back landed on
 // that blank template for any view the popup had not rendered in this page
 // load. These tests drive the real goBack() with the real router wired to
 // recording view modules, so what is asserted is which view render ran —
 // the thing that was missing.
 //
 // The rendering itself is asserted against the real popup in a real
 // browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
 // only needs showView() to work.
 const els = new Map();
 function fakeEl() {
    return {
        textContent: "",
        innerHTML: "",
        classList: {
            toggle() {},
            add() {},
            remove() {},
            contains: () => false,
        },
        remove() {},
    };
 }
 globalThis.document = {
    getElementById(id) {
        if (!els.has(id)) els.set(id, fakeEl());
        return els.get(id);
    },
 };
 // helpers.js pulls in state.js, which reads chrome.storage.local at load.
 globalThis.chrome = {
    storage: { local: { get: async () => ({}), set: async () => {} } },
 };
 const {
    showView,
    goBack,
    setBackRenderer,
    pushCurrentView,
 } = require("../src/popup/views/helpers");
 const {
    makeBackRenderer,
    markViewRendered,
    resetRenderedViews,
 } = require("../src/popup/viewRouter");
 const { state } = require("../src/shared/state");
 const ADDRESS = "0x1111111111111111111111111111111111111111";
 const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
 let calls;
 // Stand-ins for the view modules. Each records itself and then shows its
 // view, which is what every real view render ends with — so the assertions
 // can tell "rendered and shown" apart from "merely unhidden".
 function recorder(name, view) {
    return () => {
        calls.push(name);
        showView(view);
    };
 }
 function makeViews() {
    return {
        main: { show: recorder("main", "main") },
        addressDetail: { show: recorder("addressDetail", "address") },
        addressToken: { show: recorder("addressToken", "address-token") },
        receive: { show: recorder("receive", "receive") },
        settings: { show: recorder("settings", "settings") },
        settingsAddToken: {
            show: recorder("settingsAddToken", "settings-addtoken"),
        },
        confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
        transactionDetail: {
            render: recorder("transactionDetail", "transaction"),
        },
        txStatus: {
            restoreWait: () => {
                calls.push("waitTx");
                showView("wait-tx");
                return true;
            },
            renderSuccess: recorder("successTx", "success-tx"),
            renderError: recorder("errorTx", "error-tx"),
        },
    };
 }
 // The popup as it stands just after a reopen: one wallet with one address,
 // the view the popup restored onto, and the stack behind it.
 //
 // A reopen is a fresh page load, so the record of what has been rendered
 // starts empty — that emptiness is what makes the Back path render at all.
 // Returns the view modules so a test can drive forward navigation through
 // the same recorders the router renders through.
 function reopenedOn(view, stack, extra) {
    calls = [];
    resetRenderedViews();
    state.wallets = [
        {
            name: "Wallet 1",
            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
        },
    ];
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    state.selectedToken = null;
    state.viewData = null;
    state.currentView = view;
    state.viewStack = stack.slice();
    Object.assign(state, extra || {});
    // Restoring onto a view renders it, so the reopened popup has that one
    // view on the page and nothing else.
    markViewRendered(view);
    const views = makeViews();
    setBackRenderer(makeBackRenderer(state, views));
    return views;
 }
 // The reproduction from the issue, step for step.
 describe("Back onto a view the reopened popup never rendered", () => {
    test("Back from settings renders the address detail underneath", () => {
        reopenedOn("settings", ["main", "address"]);
        goBack();
        expect(calls).toEqual(["addressDetail"]);
        expect(state.currentView).toBe("address");
        expect(state.viewStack).toEqual(["main"]);
    });
    test("Back onto the token detail renders it", () => {
        reopenedOn("settings", ["main", "address", "address-token"], {
            selectedToken: TOKEN,
        });
        goBack();
        expect(calls).toEqual(["addressToken"]);
        expect(state.currentView).toBe("address-token");
    });
    test("Back onto Receive renders it", () => {
        reopenedOn("settings", ["main", "address", "receive"]);
        goBack();
        expect(calls).toEqual(["receive"]);
        expect(state.currentView).toBe("receive");
    });
    test("Back onto the transaction detail renders it", () => {
        reopenedOn("settings", ["main", "transaction"], {
            viewData: { tx: { hash: "0xdead" } },
        });
        goBack();
        expect(calls).toEqual(["transactionDetail"]);
        expect(state.currentView).toBe("transaction");
    });
    test("Back onto the transaction confirmation restores it", () => {
        reopenedOn("settings", ["main", "confirm-tx"], {
            viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
        });
        goBack();
        expect(calls).toEqual(["confirmTx"]);
        expect(state.currentView).toBe("confirm-tx");
    });
    test("Back onto the success screen renders it", () => {
        reopenedOn("settings", ["main", "success-tx"], {
            viewData: { hash: "0xdead" },
        });
        goBack();
        expect(calls).toEqual(["successTx"]);
        expect(state.currentView).toBe("success-tx");
    });
    test("Back onto the failure screen renders it", () => {
        reopenedOn("settings", ["main", "error-tx"], {
            viewData: { message: "execution reverted" },
        });
        goBack();
        expect(calls).toEqual(["errorTx"]);
        expect(state.currentView).toBe("error-tx");
    });
    test("Back onto Home renders the wallet list", () => {
        reopenedOn("settings", ["main"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("Back with an empty stack renders Home", () => {
        reopenedOn("settings", []);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
 // The guards are restoreView()'s, so a popped view whose backing data is
 // gone lands on Home rather than on an empty template.
 describe("Back onto a view whose backing data is gone", () => {
    test("the token detail with no token selected falls back to Home", () => {
        reopenedOn("settings", ["main", "address-token"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the transaction detail with no transaction falls back to Home", () => {
        reopenedOn("settings", ["main", "transaction"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the confirmation with no pending transaction falls back to Home", () => {
        reopenedOn("settings", ["main", "confirm-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("an address view with no address selected falls back to Home", () => {
        reopenedOn("settings", ["main", "receive"], {
            selectedAddress: null,
        });
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the success screen with no transaction hash falls back to Home", () => {
        reopenedOn("settings", ["main", "success-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the failure screen with no message falls back to Home", () => {
        reopenedOn("settings", ["main", "error-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("a wait that can no longer be resumed falls back to Home", () => {
        reopenedOn("settings", ["main", "wait-tx"]);
        const views = makeViews();
        views.txStatus.restoreWait = () => false;
        setBackRenderer(makeBackRenderer(state, views));
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
 // Forward navigation renders as it goes, and a second render would re-fetch
 // and clobber whatever the view holds — an unsaved edit, a request in
 // flight. So the Back path renders only a view this page load has never
 // rendered, and merely unhides every other one: the views it does not
 // render from persisted state, and the views already on the page.
 describe("what the Back path leaves alone", () => {
    test("forward navigation renders nothing by itself", () => {
        reopenedOn("address", ["main"]);
        pushCurrentView();
        showView("send");
        expect(calls).toEqual([]);
        expect(state.viewStack).toEqual(["main", "address"]);
    });
    test("Back onto a live-session view only unhides it", () => {
        reopenedOn("confirm-tx", ["main", "address", "send"]);
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("send");
    });
    test("Back renders its target exactly once", () => {
        reopenedOn("settings", ["main", "address"]);
        goBack();
        expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
    });
    test("Back onto a view this page load already rendered only unhides it", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.addressDetail.show();
        pushCurrentView();
        views.settings.show();
        calls = [];
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("address");
    });
    // The unit mirror of the regression the browser suite pins: Settings
    // reassigns its fields from persisted state on every render, so a
    // re-render on the way back discards an edit the user has not saved.
    test("Back onto Settings visited earlier in this page load does not re-render it", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.settings.show();
        pushCurrentView();
        views.settingsAddToken.show();
        calls = [];
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("settings");
    });
    // Home is the deliberate exception, unchanged from the popup's
    // behaviour before the router existed: it re-renders on every Back so
    // the wallet list reflects what changed while the user was away.
    test("Back onto Home renders it again even when it is already on the page", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.addressDetail.show();
        calls = [];
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
--- a/tests/e2e/network.js
+++ b/tests/e2e/network.js
@@ -46,24 +46,9 @@ const STUB_TX_HASH =
 const STUB_BLOCK_NUMBER = 21000000;
 // The native ETH transfer, seeded by opts.seedNativeTransfer. Its own hash
 // and an older block, so it is a second row rather than a leg of the token
 // transfer: mergeTransactions() consolidates a native entry and a token
 // transfer that share a hash into one row, which would leave nothing native
 // to open. 0.25 ETH clears the 100000 gwei dust threshold the default
 // filters apply, so the row is not silently dropped.
 const STUB_NATIVE_TX_HASH =
    "0xe7e0000000000000000000000000000000000000000000000000000000000e7e";
 const STUB_NATIVE_BLOCK_NUMBER = STUB_BLOCK_NUMBER - 1;
 const STUB_NATIVE_VALUE_WEI = "250000000000000000";
 // Fixed instant so timeAgo() output is stable across runs.
 const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
 const STUB_NATIVE_TX_TIMESTAMP = "2026-01-02T02:03:04.000000Z";
 // A 32-byte zero word. Returned for every eth_call, which is what makes
 // ethers' ENS reverse lookup resolve to "no resolver set" and return null
 // instead of throwing. A throw would be logged by src/shared/ens.js via
@@ -101,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records the whole observable shape of the error as it
+// The rejection branch records `code` as it arrives. EIP-1193 says a user
-// arrives — name, message, and whether a `code` is present at all as distinct
+// rejection is a ProviderRpcError carrying code 4001; what the page can
-// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// actually see is recorded here rather than assumed, and asserted in run.js.
 // carrying code 4001; what the page can actually see is recorded here rather
 // than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -137,7 +120,6 @@ const DAPP_HTML = [
    "                    return {",
    "                        settled: 'rejected',",
    "                        message: String((error && error.message) || error),",
    "                        name: error ? error.name : undefined,",
    "                        hasCode: !!error && 'code' in Object(error),",
    "                        code: error ? error.code : undefined,",
    "                    };",
@@ -273,25 +255,6 @@ function tokenTransferItems(address) {
    ];
 }
 // One received native ETH transfer, in the shape src/shared/transactions.js
 // parses. to.is_contract is false and there is no method, so parseTx() keeps
 // it a plain transfer rather than a contract call — which is what makes the
 // detail screen classify it "Native ETH Transfer" and leave the token
 // contract row hidden.
 function nativeTransactionItems(address) {
    return [
        {
            hash: STUB_NATIVE_TX_HASH,
            block_number: STUB_NATIVE_BLOCK_NUMBER,
            timestamp: STUB_NATIVE_TX_TIMESTAMP,
            from: { hash: STUB_COUNTERPARTY },
            to: { hash: address, is_contract: false },
            value: STUB_NATIVE_VALUE_WEI,
            status: "ok",
        },
    ];
 }
 // A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
 // this is what puts an ERC-20 in the send screen's token dropdown, which is
 // the only way the confirmation screen's ERC-20 path can be reached.
@@ -304,17 +267,12 @@ function tokenBalanceItems() {
    ];
 }
-// Full details for either seeded transaction — the detail screen fetches
+// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
-// them for whichever row was opened, and an unstubbed hash would be
+// decoder short-circuits; the on-chain detail fields still populate.
-// reported as escaping traffic. raw_input is "0x" so the calldata decoder
+function transactionDetails() {
 // short-circuits; the on-chain detail fields still populate.
 function transactionDetails(hash) {
    return {
-        hash: hash,
+        hash: STUB_TX_HASH,
-        block_number:
+        block_number: STUB_BLOCK_NUMBER,
            hash === STUB_NATIVE_TX_HASH
                ? STUB_NATIVE_BLOCK_NUMBER
                : STUB_BLOCK_NUMBER,
        nonce: 7,
        gas_used: "51000",
        gas_price: "1000000000",
@@ -518,10 +476,6 @@ function traceEnabled(raw) {
 * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
 *   transfer. Read at request time, so a test can flip it on the same
 *   options object without re-registering the route.
 * @param {boolean} [opts.seedNativeTransfer]  serve the stubbed native ETH
 *   transfer, read at request time like seedTokenTransfer. Without it the
 *   normal-transactions endpoint answers with an empty list, so there is no
 *   non-ERC-20 row to open.
 * @param {boolean} [opts.seedTokenBalance]  serve the stubbed ERC-20
 *   holding, which is what makes the token reachable from the send screen.
 * @param {string} [opts.ethBalanceWei]  hex wei answered to eth_getBalance;
@@ -593,13 +547,7 @@ async function installNetworkStubs(ctx, opts) {
        // Blockscout v2
        if (p.includes("/api/v2/")) {
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
-                const addr = blockscoutAddress(p);
+                return jsonResponse(route, { items: [] });
                return jsonResponse(route, {
                    items:
                        opts.seedNativeTransfer && addr
                            ? nativeTransactionItems(addr)
                            : [],
                });
            }
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
                const addr = blockscoutAddress(p);
@@ -616,10 +564,8 @@ async function installNetworkStubs(ctx, opts) {
                    opts.seedTokenBalance ? tokenBalanceItems() : [],
                );
            }
-            for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {
+            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
-                if (p.endsWith("/transactions/" + hash)) {
+                return jsonResponse(route, transactionDetails());
                    return jsonResponse(route, transactionDetails(hash));
                }
            }
        }
@@ -691,8 +637,6 @@ module.exports = {
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
    STUB_COUNTERPARTY,
    STUB_NATIVE_TX_HASH,
    STUB_NATIVE_VALUE_WEI,
    STUB_TOKEN,
    STUB_TX_HASH,
 };
--- a/tests/e2e/run.js
+++ b/tests/e2e/run.js
@@ -36,8 +36,6 @@ const {
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
    STUB_COUNTERPARTY,
    STUB_NATIVE_TX_HASH,
    STUB_NATIVE_VALUE_WEI,
    STUB_TOKEN,
    STUB_TX_HASH,
 } = require("./network");
@@ -171,264 +169,6 @@ test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
    assert(dots > 0, "token contract row rendered without its colour dot");
 });
 // --------------------- the rest of the #150 and #151 definition of done
 //
 // The two tests above assert that the screens #150 and #151 broke now open
 // without throwing, which is narrower than what those issues asked for.
 // The four items below are the remainder (#188): the navigation stack out
 // of Add Token, the quick-pick actually populating the field, the native
 // ETH detail path the ERC-20 fix could have regressed, and tap-to-copy.
 // Leave the transaction detail screen for the address screen it was opened
 // from. The two tests above finish on it, and so does the last test here.
 async function leaveTransactionDetail(page) {
    if (await page.isVisible("#view-transaction")) {
        await page.click("#btn-tx-back");
    }
    await openAddressDetail(page);
 }
 // Back out to Home from wherever the previous test finished.
 async function goHome(page) {
    await leaveTransactionDetail(page);
    await page.click("#btn-address-back");
    await visible(page, "#view-main");
 }
 // The navigation stack as it was actually persisted, read out of extension
 // storage rather than inferred from which screen is showing. A stale entry
 // left behind by a forward navigation that threw is invisible on screen
 // until the user presses Back one time too many — which is exactly the
 // second-order damage #150 did — so the stack itself is what gets asserted.
 function persistedViewStack(page) {
    return page.evaluate(
        () =>
            new Promise((resolve) => {
                chrome.storage.local.get("autistmask", (r) => {
                    resolve((r.autistmask && r.autistmask.viewStack) || []);
                });
            }),
    );
 }
 // saveState() is fired from showView() without being awaited, so the write
 // lands shortly after the screen does. Polling for the expected stack keeps
 // that race out of the assertion; a stack that never becomes the expected
 // one fails with what it actually was.
 const VIEW_STACK_SETTLE_MS = 5000;
 async function waitForViewStack(page, expected, where) {
    const want = JSON.stringify(expected);
    const deadline = Date.now() + VIEW_STACK_SETTLE_MS;
    let seen;
    for (;;) {
        seen = await persistedViewStack(page);
        if (JSON.stringify(seen) === want) return;
        if (Date.now() >= deadline) break;
        await sleep(50);
    }
    throw new Error(
        "navigation stack " +
            where +
            " is " +
            JSON.stringify(seen) +
            ", expected " +
            want,
    );
 }
 // The invariant is stated as a delta against whatever the earlier tests
 // left on the stack, not as an absolute: a round trip into Add Token and
 // back out must leave the stack exactly as it found it. That is what "no
 // duplicated or orphaned stack entry" means, and it holds whatever the
 // starting depth is.
 test("Back from Add Token unwinds the stack exactly once (#150)", async (env) => {
    await goHome(env.page);
    const base = await persistedViewStack(env.page);
    await env.page.locator("#wallet-list .btn-addr-info").first().click();
    await visible(env.page, "#view-address");
    await waitForViewStack(env.page, base.concat("main"), "on address detail");
    await env.page.click("#btn-add-token");
    await visible(env.page, "#view-add-token");
    await waitForViewStack(
        env.page,
        base.concat("main", "address"),
        "on the add token screen",
    );
    await env.page.click("#btn-add-token-back");
    await visible(env.page, "#view-address");
    assert(
        !(await env.page.isVisible("#view-add-token")),
        "the add token screen is still showing after Back",
    );
    await waitForViewStack(
        env.page,
        base.concat("main"),
        "after Back from add token",
    );
    await env.page.click("#btn-address-back");
    await visible(env.page, "#view-main");
    await waitForViewStack(env.page, base, "after a second Back");
 });
 test("a common-token quick-pick fills in the contract address (#150)", async (env) => {
    await openAddressDetail(env.page);
    await env.page.click("#btn-add-token");
    await visible(env.page, "#view-add-token");
    const before = await env.page.inputValue("#add-token-address");
    assert(
        before === "",
        "the add token screen opened with the address field already filled: " +
            JSON.stringify(before),
    );
    const pick = env.page.locator("#common-token-list .common-token").first();
    const wanted = await pick.getAttribute("data-address");
    assert(
        /^0x[0-9a-fA-F]{40}$/.test(wanted || ""),
        "the first quick-pick button carries no contract address: " +
            JSON.stringify(wanted),
    );
    await pick.click();
    const after = await env.page.inputValue("#add-token-address");
    assert(
        after === wanted,
        "clicking the " +
            (await pick.innerText()).trim() +
            " quick-pick left the address field as " +
            JSON.stringify(after) +
            ", expected " +
            JSON.stringify(wanted),
    );
    await env.page.click("#btn-add-token-back");
    await visible(env.page, "#view-address");
 });
 // The native amount as the transaction list writes it (four decimals) and
 // as the detail screen writes it (full precision). Both are rendered here
 // from the fixture rather than read off the screen, so the assertions
 // compare against the wei the stub served.
 const NATIVE_ROW_TEXT =
    parseFloat(formatEther(STUB_NATIVE_VALUE_WEI)).toFixed(4) + " ETH";
 const NATIVE_DETAIL_TEXT = formatEther(STUB_NATIVE_VALUE_WEI) + " ETH";
 test("the native ETH transaction detail still renders (#151)", async (env) => {
    // The ERC-20 fix could only have regressed this path by making the
    // token-contract branch run for a transfer that has no contract, so
    // the assertions below are as much about that row staying hidden as
    // about the screen coming up.
    env.routeOpts.seedNativeTransfer = true;
    await env.page.reload();
    await openAddressDetail(env.page);
    const row = env.page
        .locator("#tx-list .tx-row")
        .filter({ hasText: NATIVE_ROW_TEXT });
    await row.waitFor({ state: "visible", timeout: 30000 });
    await row.click();
    await visible(env.page, "#view-transaction");
    const hash = await env.page.locator("#tx-detail-hash").innerText();
    assert(
        hash.includes(STUB_NATIVE_TX_HASH),
        "the native transaction detail shows the wrong hash: " + hash,
    );
    const type = (await env.page.locator("#tx-detail-type").innerText()).trim();
    assert(
        type === "Native ETH Transfer",
        "the native transaction was classified " + JSON.stringify(type),
    );
    const value = await env.page.locator("#tx-detail-value").innerText();
    assert(
        value.includes(NATIVE_DETAIL_TEXT),
        "the native transaction detail shows " +
            JSON.stringify(value) +
            ", expected it to contain " +
            NATIVE_DETAIL_TEXT,
    );
    const native = await env.page.locator("#tx-detail-native").innerText();
    assert(
        native.includes(STUB_NATIVE_VALUE_WEI + " wei"),
        "the raw quantity row shows " +
            JSON.stringify(native) +
            ", expected the value in wei",
    );
    assert(
        !(await env.page.isVisible("#tx-detail-token-contract-section")),
        "the token contract row is showing on a transfer that has no token " +
            "contract",
    );
    // Back to one seeded transaction for everything after this: the tests
    // below were written against a list holding the token transfer alone.
    env.routeOpts.seedNativeTransfer = false;
 });
 test("tap-to-copy on the transaction detail screen copies the address (#151)", async (env) => {
    // Read the clipboard back rather than watching the handler run: what
    // #151 asks for is the address reaching the clipboard, and a spy on
    // navigator.clipboard would assert the call and not the effect.
    //
    // Granted context-wide rather than for the popup's origin: an
    // origin-scoped grant is refused for chrome-extension: URLs, which
    // both Playwright and Chrome treat as opaque here.
    await env.ctx.grantPermissions(["clipboard-read", "clipboard-write"]);
    await leaveTransactionDetail(env.page);
    const row = env.page
        .locator("#tx-list .tx-row")
        .filter({ hasText: STUB_TOKEN.symbol });
    await row.waitFor({ state: "visible", timeout: 30000 });
    await row.click();
    await visible(env.page, "#view-transaction");
    await visible(env.page, "#tx-detail-token-contract-section");
    // Seed a sentinel first, so a clipboard that nothing writes to cannot
    // pass on whatever was left in it.
    const SENTINEL = "e2e-clipboard-untouched";
    await env.page.evaluate((s) => navigator.clipboard.writeText(s), SENTINEL);
    const seeded = await env.page.evaluate(() =>
        navigator.clipboard.readText(),
    );
    assert(
        seeded === SENTINEL,
        "the harness could not seed the clipboard, so the assertion below " +
            "would prove nothing; it read back " +
            JSON.stringify(seeded),
    );
    await env.page.locator("#tx-detail-token-contract [data-copy]").click();
    const copied = await env.page.evaluate(() =>
        navigator.clipboard.readText(),
    );
    assert(
        copied.toLowerCase() === STUB_TOKEN.address,
        "tapping the token contract address put " +
            JSON.stringify(copied) +
            " on the clipboard, expected " +
            STUB_TOKEN.address,
    );
    const flash = await env.page.locator("#flash-msg").innerText();
    assert(
        flash.trim() === "Copied!",
        "the copy gave no confirmation, flash line reads " +
            JSON.stringify(flash),
    );
 });
 // -------------------------------------------- recovery phrase (#161)
 // The gear toggles, so pressing it while Settings is already up leaves it.
@@ -679,172 +419,6 @@ test("reopening the popup never lands on the phrase screen (#161)", async (env)
    assertWiped(st, env.phrase, "after reopening the popup");
 });
 // ------------------------------- Back after reopening the popup (#268)
 // A reopened popup renders the wallet list and the view it restores onto,
 // and nothing else: every other screen is still the blank static template
 // from index.html. Back used to only unhide its target, which is why these
 // have to run against the real popup — the template is present and
 // well-formed, so only its emptiness distinguishes the defect, and only a
 // real reopen produces it.
 // Everything the address screen must have on it, read out of the DOM.
 function addressScreenState(page) {
    return page.evaluate(() => {
        const line = document.getElementById("address-line");
        const balances = document.getElementById("address-balances");
        return {
            hidden: document
                .getElementById("view-address")
                .classList.contains("hidden"),
            line: line ? line.innerText.trim() : "",
            balances: balances ? balances.innerText.trim() : "",
        };
    });
 }
 // Close and reopen the page rather than reload it: that is what the toolbar
 // popup does, and it is the only thing that produces the unrendered views.
 async function reopenPopup(env, restoredView) {
    await env.page.close();
    env.page = await openPopup(env.ctx, env.popupUrl);
    await visible(env.page, restoredView);
 }
 // The reproduction from the issue, step for step.
 test("Back after reopening the popup renders the address screen (#268)", async (env) => {
    await openAddressDetail(env.page);
    const before = await addressScreenState(env.page);
    assert(
        before.line.length > 0,
        "the address screen was blank to begin with",
    );
    await env.page.click("#btn-settings");
    await visible(env.page, "#view-settings");
    await reopenPopup(env, "#view-settings");
    await env.page.click("#btn-settings-back");
    await visible(env.page, "#view-address");
    const after = await addressScreenState(env.page);
    assert(
        after.line === before.line,
        "the address line reads " +
            JSON.stringify(after.line) +
            ", expected " +
            JSON.stringify(before.line),
    );
    assert(
        after.balances.includes("ETH"),
        "the balances read " + JSON.stringify(after.balances),
    );
 });
 // The same defect one screen further in. Receive holds the address twice
 // over — as text and as the QR code the sender scans — and a blank one is
 // worse than a missing screen.
 // Everything the Receive screen must have on it. The QR code is read as
 // pixels, not as an element: the blank template carries the canvas too, a
 // default 300x150 one with nothing drawn on it and every pixel fully
 // transparent. A drawn QR paints an opaque background across the whole
 // canvas, so a single opaque pixel is the whole question.
 function receiveScreenState(page) {
    return page.evaluate(() => {
        const block = document.getElementById("receive-address-block");
        const canvas = document.getElementById("receive-qr");
        const px = canvas
            .getContext("2d")
            .getImageData(0, 0, canvas.width, canvas.height).data;
        let opaque = 0;
        for (let i = 3; i < px.length; i += 4) {
            if (px[i] > 0) opaque += 1;
        }
        return {
            address: block.dataset.full || "",
            text: block.innerText.trim(),
            qrOpaquePixels: opaque,
        };
    });
 }
 test("Back after reopening the popup renders the Receive screen (#268)", async (env) => {
    await openAddressDetail(env.page);
    await env.page.click("#btn-receive");
    await visible(env.page, "#view-receive");
    const before = await receiveScreenState(env.page);
    assert(
        /^0x[0-9a-fA-F]{40}$/.test(before.address),
        "Receive showed no address to begin with: " +
            JSON.stringify(before.address),
    );
    await env.page.click("#btn-settings");
    await visible(env.page, "#view-settings");
    await reopenPopup(env, "#view-settings");
    await env.page.click("#btn-settings-back");
    await visible(env.page, "#view-receive");
    const shown = await receiveScreenState(env.page);
    assert(
        shown.address === before.address,
        "Receive shows " +
            JSON.stringify(shown.address) +
            ", expected " +
            JSON.stringify(before.address),
    );
    assert(
        shown.text.includes(before.address),
        "the Receive address is not on screen: " + JSON.stringify(shown.text),
    );
    assert(shown.qrOpaquePixels > 0, "Receive shows an unpainted QR code");
    // Leave the suite where it found it.
    await env.page.click("#btn-receive-back");
    await visible(env.page, "#view-address");
    await env.page.click("#btn-address-back");
    await visible(env.page, "#view-main");
 });
 // The other half of the requirement: Back renders a screen this page load
 // never rendered, and must NOT re-render one it already has on screen.
 // settings.show() reassigns #settings-rpc from persisted state, so
 // re-rendering Settings on the way back would silently revert whatever the
 // user typed and had not saved yet — and they could then press Save and
 // store the value they believed they had replaced. No reopen here: this is
 // an ordinary in-session forward-and-back, which is exactly why the render
 // must not happen.
 test("Back onto Settings keeps unsaved input (#268)", async (env) => {
    await visible(env.page, "#view-main");
    await env.page.click("#btn-settings");
    await visible(env.page, "#view-settings");
    const typed = "https://rpc.example.invalid/unsaved";
    await env.page.fill("#settings-rpc", typed);
    await env.page.click("#btn-settings-add-token");
    await visible(env.page, "#view-settings-addtoken");
    await env.page.click("#btn-settings-addtoken-back");
    await visible(env.page, "#view-settings");
    const kept = await env.page.inputValue("#settings-rpc");
    assert(
        kept === typed,
        "the unsaved RPC URL reads " +
            JSON.stringify(kept) +
            ", expected " +
            JSON.stringify(typed),
    );
    // Leave the suite where it found it. The typed value was never saved,
    // and Settings reloads the field from state next time it renders.
    await env.page.click("#btn-settings-back");
    await visible(env.page, "#view-main");
 });
 // -------------------------------------------- address removal (#162)
 // Number of address rows across every wallet in the list, counted in the DOM
@@ -2017,14 +1591,15 @@ async function lastResponseError(page) {
 }
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and EIP-1193 code 4001 is present both
+// rather than hanging or resolving, and the response that crossed the
-// on the wire and on the Error the calling page catches.
+// boundary carried EIP-1193 code 4001.
 //
-// Both ends matter because they used to disagree. The code crossed the
+// The code is asserted on the wire because that is the only place it
-// boundary correctly and src/content/inpage.js then threw it away, rebuilding
+// survives. src/content/inpage.js rebuilds the rejection as `new
-// every rejection as `new Error(error.message)` — so a dApp branching on
+// Error(error.message)`, so the Error the calling page catches carries the
-// `err.code === 4001` saw undefined and could not tell a refusal from a
+// message and no code. That is reported rather than asserted either way —
-// failure (#274). Asserting only the wire would leave that gap invisible.
+// locking in the current behaviour would make the gap permanent, and
 // asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
    const outcome = await settleRequest(page, key);
    assert(
@@ -2046,32 +1621,15 @@ async function assertUserRejection(page, key, label) {
            " did not carry EIP-1193 code 4001 across the boundary: " +
            JSON.stringify(error),
    );
    assert(
        outcome.hasCode,
        label +
            " reached the page as an error with no code property at all, so a " +
            "dApp cannot tell the user's refusal from a failure: " +
            JSON.stringify(outcome),
    );
    assert(
        outcome.code === 4001,
        label +
            " reached the page with code " +
            JSON.stringify(outcome.code) +
            " rather than EIP-1193 4001",
    );
    assert(
        outcome.name === "ProviderRpcError",
        label +
            " reached the page as " +
            JSON.stringify(outcome.name) +
            " rather than an EIP-1193 ProviderRpcError",
    );
    console.log(
        "# " +
            label +
-            ": code 4001 on the wire and on the page's " +
+            ": boundary code=" +
-            outcome.name,
+            error.code +
            " page Error.code=" +
            JSON.stringify(outcome.code) +
            " page Error carries a code=" +
            outcome.hasCode,
    );
    return outcome;
 }
@@ -2631,7 +2189,6 @@ async function main() {
    // starting state of a run is readable without hunting through tests.
    const routeOpts = {
        seedTokenTransfer: false,
        seedNativeTransfer: false,
        seedTokenBalance: false,
        ethBalanceWei: null,
        failGasEstimate: false,
--- a/tests/inpageErrors.test.js
+++ b/tests/inpageErrors.test.js
@@ -1,310 +0,0 @@
 // The EIP-1193 error the page actually catches (src/content/inpage.js).
 //
 // The bug this pins down (issue #274): the provider rebuilt every failure as
 // `new Error(error.message)`, so the `code` the background produced and the
 // content script relayed intact was thrown away in the last hop. A dApp
 // checking `err.code === 4001` — the standard way to tell "the user said no"
 // from "the wallet broke" — saw undefined, and well-behaved sites showed an
 // error or retried instead of accepting the refusal.
 //
 // inpage.js is a bare IIFE injected into the page's JS context, not a module:
 // it takes no import and exports nothing, and reaches for `window` at load.
 // So it is evaluated here the way the browser evaluates it, against a stub
 // window, and the provider is collected from `window.ethereum`. The globals it
 // touches are passed in as function parameters rather than assigned to
 // globalThis: nothing leaks between tests, and the source is compiled in this
 // realm, so the errors it constructs are comparable against this file's own
 // `Error` — which a second realm's intrinsics would silently defeat.
 //
 // There is no jsdom in this repo; see tests/txStatus.test.js.
 const fs = require("fs");
 const path = require("path");
 const { webcrypto } = require("crypto");
 const SOURCE = fs.readFileSync(
    path.join(__dirname, "..", "src", "content", "inpage.js"),
    "utf8",
 );
 const loadInto = new Function(
    "window",
    "self",
    "crypto",
    "Event",
    "CustomEvent",
    SOURCE,
 );
 class StubEvent {
    constructor(type) {
        this.type = type;
    }
 }
 class StubCustomEvent extends StubEvent {
    constructor(type, init) {
        super(type);
        this.detail = init && init.detail;
    }
 }
 // Every code the background emits on the RPC path today, read out of
 // src/background/index.js. The provider must not know this list — it passes
 // through whatever arrived — but the cases below are the real ones.
 const REJECTED = 4001; // user rejected the request
 const UNAUTHORIZED = 4100; // site not connected / wrong address
 const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
 // A stub window with the four things inpage.js touches: message listeners,
 // postMessage out to the content script, window.ethereum, and dispatchEvent
 // for the EIP-6963 announcement.
 function loadProvider() {
    const messageListeners = [];
    const posted = [];
    const win = {
        addEventListener(type, fn) {
            if (type === "message") messageListeners.push(fn);
        },
        removeEventListener(type, fn) {
            const i = messageListeners.indexOf(fn);
            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
        },
        postMessage(data) {
            posted.push(data);
        },
        dispatchEvent() {
            return true;
        },
    };
    win.window = win;
    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
    // Deliver the content script's answer to an outstanding request. The id is
    // read back off the wire rather than assumed: inpage.js issues its own
    // eth_chainId at load, so the first id a test sees is not 1.
    function respond(response) {
        const request = posted
            .filter((m) => m.type === "AUTISTMASK_REQUEST")
            .pop();
        expect(request).toBeDefined();
        const event = {
            source: win,
            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
        };
        for (const fn of messageListeners.slice()) fn(event);
    }
    return { provider: win.ethereum, posted, respond };
 }
 // Start a request, answer it with `response`, and hand back the rejection.
 // Fails the test if the call resolves instead.
 async function rejectionFrom(start, response) {
    const { provider, respond } = loadProvider();
    const settled = start(provider).then(
        (result) => ({ resolved: result }),
        (error) => ({ error }),
    );
    // The provider posts synchronously, so the request is already on the wire.
    respond(response);
    const outcome = await settled;
    expect(outcome).not.toHaveProperty("resolved");
    return outcome.error;
 }
 describe("an EIP-1193 code reaches the page", () => {
    test("a user rejection arrives as code 4001", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
    test("it is a ProviderRpcError, and an Error", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err).toBeInstanceOf(Error);
        expect(err.name).toBe("ProviderRpcError");
    });
    test("4100 unauthorized arrives intact", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
        );
        expect(err.code).toBe(UNAUTHORIZED);
        expect(err.message).toBe("Unauthorized");
    });
    test("4902 unrecognized chain arrives intact", async () => {
        const message =
            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "wallet_switchEthereumChain" }),
            { error: { code: UNRECOGNIZED_CHAIN, message } },
        );
        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
        expect(err.message).toBe(message);
    });
    // The provider is not allowed to know the list above: a code added to the
    // background later must reach the page without this file being edited.
    test("a code the provider has never heard of is passed through", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_accounts" }),
            { error: { code: 4900, message: "Disconnected" } },
        );
        expect(err.code).toBe(4900);
    });
    test("data is carried when the boundary sent it", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_call" }),
            {
                error: {
                    code: -32000,
                    message: "execution reverted",
                    data: "0x08c379a0",
                },
            },
        );
        expect(err.code).toBe(-32000);
        expect(err.data).toBe("0x08c379a0");
    });
    test("no data property is invented when the boundary sent none", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect("data" in err).toBe(false);
    });
 });
 describe("the message is untouched", () => {
    test("a coded error keeps the message byte for byte", async () => {
        const message =
            "This site asked to sign as an address that is not " +
            "the active one.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign" }),
            { error: { code: UNAUTHORIZED, message } },
        );
        expect(err.message).toBe(message);
    });
    test("an error the background sent with no code keeps its message", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err.message).toBe("No accounts available");
    });
    // A ProviderRpcError whose code is undefined would claim a conformance it
    // does not have, and `'code' in err` is exactly what a careful dApp asks.
    test("an error with no code gets no code property at all", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err).toBeInstanceOf(Error);
        expect("code" in err).toBe(false);
    });
    test("an error with no message keeps the generic fallback", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { code: REJECTED } },
        );
        expect(err.message).toBe("Request failed");
        expect(err.code).toBe(REJECTED);
    });
 });
 // Every entry point the provider exposes, not just eth_requestAccounts. They
 // all funnel through the same response listener, and this is what says so.
 describe("every request path carries the code", () => {
    const rejection = {
        error: { code: REJECTED, message: "User rejected the request." },
    };
    test("request()", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("enable()", async () => {
        const err = await rejectionFrom((p) => p.enable(), rejection);
        expect(err.code).toBe(REJECTED);
    });
    test("send(method, params)", async () => {
        const err = await rejectionFrom(
            (p) => p.send("eth_requestAccounts", []),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("send({ method, params })", async () => {
        const err = await rejectionFrom(
            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("sendAsync() hands the code to its callback", async () => {
        const { provider, respond } = loadProvider();
        const called = new Promise((resolve) => {
            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
                resolve(e),
            );
        });
        respond(rejection);
        const err = await called;
        expect(err.name).toBe("ProviderRpcError");
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
 });
 describe("the success path is unchanged", () => {
    test("a result still resolves", async () => {
        const { provider, respond } = loadProvider();
        const settled = provider.request({ method: "eth_requestAccounts" });
        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
        await expect(settled).resolves.toEqual([
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        ]);
        expect(provider.selectedAddress).toBe(
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        );
    });
 });