fix: render the view "Back" lands on after the popup is reopened (closes #268)

goBack() only unhid its target. A reopened popup renders the wallet list
and the one view restoreView() lands on, so every other view is still the
blank static template from index.html: pressing Back from Settings onto an
address showed an empty address line and no balances, and the same held for
address-token, receive, confirm-tx and transaction.

The per-view dispatch and its data guards move out of restoreView() into
src/popup/viewRouter.js, and goBack() now routes a popped view through the
same code by way of a renderer index.js registers with setBackRenderer().
A view whose backing state is gone falls back to Home the way the restore
does, rather than showing an empty template.

The Back path renders only a view this page load has not rendered yet.
viewRouter.js keeps a page-load-scoped set of rendered views, written by
showView() — the last thing every render path runs, forward navigation and
the restore alike, so a view added later registers itself rather than
needing to be remembered. Back onto a view already in that set unhides it
and nothing more, exactly as it does for a view outside RESTORABLE_VIEWS:
rendering a second time would re-fetch and overwrite what the view holds,
such as an edit typed into Settings and not yet saved. Home stays the
exception and is re-rendered on every Back, as it was when goBack() called
the renderWalletList() registered through setRenderMain(), so the wallet
list reflects what changed while the user was away from it.

tests/backNavigation.test.js drives the real goBack() over the reproduction
and over each of address-token, receive, confirm-tx, transaction, success-tx
and error-tx, with and without their backing state, and pins that a view
this page load already rendered — a live-session view, or Settings revisited
— is only unhidden, while Home still re-renders. tests/e2e/run.js adds three
cases against the real popup in a real browser, because make check cannot
see a blank view: a real close and reopen then Back onto the address screen
and onto Receive, and an in-session Back onto Settings that must keep
unsaved input. All three were demonstrated failing first.

README.md

@@ -638,6 +638,21 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 
+A reopened popup renders the wallet list and the one screen it restores onto,
+and nothing else, so every screen on the stack behind that one is still the
+blank template from `index.html`. "Back" therefore renders its target rather
+than only unhiding it, through the same dispatch and data guards as the restore
+(`src/popup/viewRouter.js`), and falls back to Home when the state the target
+would render is gone.
+
+It renders only a screen this page load has not rendered yet. Forward navigation
+renders as it goes, and `viewRouter.js` records every screen that reaches
+`showView()`, so "Back" onto a screen already on the page unhides it and nothing
+more — rendering it a second time would re-fetch and overwrite what it holds,
+such as an edit typed into Settings and not yet saved. Home is the one screen
+"Back" always re-renders, so the wallet list reflects anything that changed
+while the user was away from it.
+
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret
@@ -1163,11 +1178,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
   opening the window, so the screen shows a complete transaction and the signed
   artifact can be compared with it field for field. A request that cannot be
   populated — unreachable node, reverting gas estimate — opens no window and is
-  failed back to the site. Only one transaction approval exists at a time:
-  populating fixes the nonce, so a second `eth_sendTransaction` arriving while
-  one is unanswered is refused with EIP-1193 code `-32002` rather than being
-  populated at the same nonce. It opens no window and takes no nonce, and the
-  site can send it again once the pending one is answered.
+  failed back to the site.
 - **Elements**:
     - "Transaction Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing

TODO.md

@@ -45,51 +45,23 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-14: One transaction approval at a time. Populating in the background
-  before the window opens is what makes the displayed object the verified
-  object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
-  concurrently took the same nonce from a node that had seen neither broadcast,
-  and the second could then never be sent, because the only way to give it a
-  fresh nonce is to populate it again after the user has read the old one off
-  the screen. A second request is now refused with EIP-1193 `-32002` while one
-  is unanswered — before anything is populated, so no second nonce is allocated
-  and no second window opens — and the slot is freed when the page has its
-  answer. Signature approvals are not gated, consuming no nonce. A collision
-  that does happen is also reported accurately now: a broadcast the node refused
-  for the nonce, and an approval carrying a nonce this worker has already
-  broadcast (caught before the node is asked at all), both say the transaction
-  did not reach the network and to send it again, instead of warning that it may
-  have sent. `already known` deliberately keeps the ambiguous wording, because a
-  node that says it has the transaction has it
-  ([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
-- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
-  rebuilt every failure as `new Error(error.message)`, so the code the
-  background produced and the content script relayed intact was dropped in the
-  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
-  the user deliberately declined was indistinguishable from one that broke. The
-  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
-  boundary sent one, `data`, passed through verbatim rather than matched against
-  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
-  here. An error the background sent with no code stays a plain `Error` with no
-  `code` property, and `message` is unchanged in every case. All four request
-  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
-  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
-  now requires it on the page's Error as well as on the wire, for all four
-  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
-- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
-  that bear it, not to one of them. A ticker is not unique: seven of the 512
-  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
-  share a symbol with another bundled entry at a different real contract, and
-  the table, built from the list first-wins, kept only the earlier one. The
-  other seven were judged spoofs of their own symbol at their own address and
-  hidden from the balance list, the history and the send selector, so a holder
-  could not spend them. Both contracts of each pair come from the same CoinGecko
-  fetch of 2026-02-27, so neither was stale and neither was dropped.
-  `isSpoofedSymbol()` asks set membership instead of equality, which does not
-  loosen the rule — a contract outside the set is still a spoof — and a test now
-  walks `TOKENS` asserting no bundled token is filtered at its own address,
-  which is the walk the suite lacked
-  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
+- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
+  it. A reopened popup renders the wallet list and the one screen it restores
+  onto, so every screen further down the stack was still the blank template from
+  `index.html`, and Back walked straight onto it — an empty address, no
+  balances, no QR code. The Back path now goes through the same per-view
+  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
+  with `restoreView()`), falling back to Home when the state the target would
+  render is gone. It renders only a view this page load has not rendered yet:
+  `viewRouter.js` records every view that reaches `showView()`, which is where
+  forward navigation and the restore both end, so Back onto a view already on
+  the page unhides it and nothing more. That is what keeps a second render from
+  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
+  a transaction list already loaded. Home is the exception and is always
+  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
+  and by three end-to-end cases against the real popup, each demonstrated
+  failing on the unfixed build
+  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: The dApp approval round trips are driven end to end in the
   browser. A test page served by the harness speaks EIP-1193 to the real inpage
   provider through the real content script, background worker and approval popup

src/background/index.js

@@ -24,7 +24,6 @@ const {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
-    TX_STAGE_NONCE,
 } = require("../shared/approvalVerify");
 const { prepareApprovalTx } = require("../shared/approvalTx");
 const {
@@ -58,81 +57,6 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
-// One transaction approval at a time, wallet-wide.
-//
-// The transaction a site asks for is populated before its approval window
-// opens, so that the object the user is shown is the object the signed
-// artifact is verified against. Populating fixes the nonce. Two requests
-// populated concurrently therefore take the SAME nonce — the node reports the
-// same pending count to both, neither having been broadcast — and whichever is
-// broadcast second is refused by the network for a nonce it can never be
-// re-signed at, because re-signing it would mean signing something other than
-// what was displayed.
-//
-// So the second request is refused while the first is unanswered. It is
-// refused before anything is populated, so no second nonce is allocated at
-// all, and while the page is still waiting with nothing on screen. The
-// alternatives were considered and rejected in
-// https://git.eeqj.de/sneak/AutistMask/issues/271: populating again at Confirm
-// puts a nonce on screen that is not the nonce that gets signed, and
-// allocating around in-flight approvals makes the wallet's own bookkeeping the
-// authority on a nonce the network has not accepted, which an abandoned
-// approval then leaves a hole in.
-//
-// Sign approvals are not gated: a signature consumes no nonce.
-let txApprovalSlotHeld = false;
-
-// EIP-1474 "resource unavailable": the standard code for a request that is
-// refused because another one is already pending.
-const TX_APPROVAL_PENDING_CODE = -32002;
-
-const TX_APPROVAL_PENDING_MESSAGE =
-    "Another transaction is already waiting to be approved in AutistMask," +
-    " so this one was not sent. Please answer that request, then send this" +
-    " one again.";
-
-// Take the slot, or refuse. Called before the first await of the
-// eth_sendTransaction handler, so two requests arriving in the same tick
-// cannot both pass it.
-function reserveTxApprovalSlot() {
-    if (txApprovalSlotHeld) return false;
-    txApprovalSlotHeld = true;
-    return true;
-}
-
-function releaseTxApprovalSlot() {
-    txApprovalSlotHeld = false;
-}
-
-// Nonces this worker has already handed to the node, per address. This is the
-// wallet's own knowledge that a nonce is spent, and it is checked before a
-// broadcast rather than after: a node's pending count can lag a transaction it
-// has itself just accepted, and a request populated inside that window would
-// otherwise be signed and sent at a nonce this wallet has already used.
-//
-// The record dies with the worker, which is correct rather than merely
-// convenient: after a restart the node's count is the only answer available,
-// and a transaction of this wallet's that the node has forgotten is one the
-// user does want to be able to send again.
-const broadcastNonces = {};
-
-function broadcastNoncesFor(address) {
-    const key = String(address || "").toLowerCase();
-    if (!broadcastNonces[key]) broadcastNonces[key] = new Set();
-    return broadcastNonces[key];
-}
-
-// An approved transaction's nonce as a decimal string, or null if it cannot be
-// read as a number. Verification refuses an unreadable nonce before this is
-// ever reached; null here only keeps the record from holding junk.
-function approvedNonce(approvedTx) {
-    try {
-        return BigInt(approvedTx.nonce).toString();
-    } catch {
-        return null;
-    }
-}
-
 async function getState() {
     const result = await storageApi.get("autistmask");
     return (
@@ -661,24 +585,68 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "eth_sendTransaction") {
-        // Synchronous, before any await: two requests delivered in the same
-        // tick must not both get past this.
-        if (!reserveTxApprovalSlot()) {
+        const s = await getState();
+        const activeAddress = await getActiveAddress();
+        if (!activeAddress)
+            return { error: { message: "No accounts available" } };
+
+        const hostname = extractHostname(origin);
+        const allowed = s.allowedSites[activeAddress] || [];
+        if (
+            !allowed.includes(hostname) &&
+            !connectedSites[origin + ":" + activeAddress]
+        ) {
+            return { error: { code: 4100, message: "Unauthorized" } };
+        }
+
+        const txParams = params?.[0] || {};
+        if (namesAnotherAddress(txParams.from, activeAddress)) {
             return {
                 error: {
-                    code: TX_APPROVAL_PENDING_CODE,
-                    message: TX_APPROVAL_PENDING_MESSAGE,
+                    code: 4100,
+                    message:
+                        "This site asked to send from an address that is not the active one.",
                 },
             };
         }
+
+        // Populate here, before any window opens, so that the transaction the
+        // user is shown is a complete one and is the same object the signed
+        // artifact is checked against. A failure raises no approval at all and
+        // is reported to the requesting page; see approvalTx.js.
+        let approvedTx;
         try {
-            return await handleSendTransaction(params, origin);
-        } finally {
-            // Held until the page has its answer — the approval was broadcast,
-            // rejected, or retired by a closed window — because until then its
-            // nonce is allocated and unspent.
-            releaseTxApprovalSlot();
+            approvedTx = await prepareApprovalTx(
+                getProvider(await getRpcUrl()),
+                activeAddress,
+                txParams,
+            );
+        } catch (e) {
+            return { error: { message: e.message } };
         }
+
+        // Population is a network round trip, and the user can switch address
+        // during it. Raising the approval anyway would put an account on the
+        // screen that the wallet is no longer on, and it could never be signed
+        // — the signing handler refuses exactly that. Refuse it here instead,
+        // while the page is still waiting and nothing has been displayed.
+        if (!sameAddress(await getActiveAddress(), activeAddress)) {
+            return {
+                error: {
+                    message:
+                        "The active address changed while this transaction was being prepared, so it was not sent.",
+                },
+            };
+        }
+
+        const decision = await requestTxApproval(
+            origin,
+            hostname,
+            approvedTx,
+            activeAddress,
+        );
+        if (decision.error) return { error: decision.error };
+        return { result: decision.txHash };
     }
 
     // Proxy safe read-only methods to the RPC node
@@ -694,73 +662,6 @@ async function handleRpc(method, params, origin) {
     return { error: { message: "Unsupported method: " + method } };
 }
 
-// The body of eth_sendTransaction, from the connection check through to the
-// user's decision. Its caller holds the single transaction-approval slot for
-// as long as this runs.
-async function handleSendTransaction(params, origin) {
-    const s = await getState();
-    const activeAddress = await getActiveAddress();
-    if (!activeAddress) return { error: { message: "No accounts available" } };
-
-    const hostname = extractHostname(origin);
-    const allowed = s.allowedSites[activeAddress] || [];
-    if (
-        !allowed.includes(hostname) &&
-        !connectedSites[origin + ":" + activeAddress]
-    ) {
-        return { error: { code: 4100, message: "Unauthorized" } };
-    }
-
-    const txParams = params?.[0] || {};
-    if (namesAnotherAddress(txParams.from, activeAddress)) {
-        return {
-            error: {
-                code: 4100,
-                message:
-                    "This site asked to send from an address that is not the active one.",
-            },
-        };
-    }
-
-    // Populate here, before any window opens, so that the transaction the
-    // user is shown is a complete one and is the same object the signed
-    // artifact is checked against. A failure raises no approval at all and
-    // is reported to the requesting page; see approvalTx.js.
-    let approvedTx;
-    try {
-        approvedTx = await prepareApprovalTx(
-            getProvider(await getRpcUrl()),
-            activeAddress,
-            txParams,
-        );
-    } catch (e) {
-        return { error: { message: e.message } };
-    }
-
-    // Population is a network round trip, and the user can switch address
-    // during it. Raising the approval anyway would put an account on the
-    // screen that the wallet is no longer on, and it could never be signed
-    // — the signing handler refuses exactly that. Refuse it here instead,
-    // while the page is still waiting and nothing has been displayed.
-    if (!sameAddress(await getActiveAddress(), activeAddress)) {
-        return {
-            error: {
-                message:
-                    "The active address changed while this transaction was being prepared, so it was not sent.",
-            },
-        };
-    }
-
-    const decision = await requestTxApproval(
-        origin,
-        hostname,
-        approvedTx,
-        activeAddress,
-    );
-    if (decision.error) return { error: decision.error };
-    return { result: decision.txHash };
-}
-
 // Broadcast chainChanged to all tabs when the network is switched.
 function broadcastChainChanged(chainId) {
     tabsApi.query({}, (tabs) => {
@@ -1058,7 +959,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             sendResponse({
                 error: outcome.error,
                 retryable: outcome.retryable,
-                stage: outcome.stage,
+                stage: TX_STAGE_SIGN,
             });
             return false;
         }
@@ -1118,28 +1019,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: outcome.stage,
-                });
-                return;
-            }
-
-            // A nonce this worker has already broadcast for this address. The
-            // node is not asked: it has answered once already, and the wallet
-            // holding the receipt of that answer is what makes this failure
-            // one the user can be told did not reach the network.
-            const nonce = approvedNonce(approval.approvedTx);
-            const spent = broadcastNoncesFor(approval.approvedFrom);
-            if (nonce !== null && spent.has(nonce)) {
-                const outcome = describeTxFailure(TX_STAGE_NONCE, null);
-                settleApproval(
-                    msg.id,
-                    { error: { message: outcome.error } },
-                    { holdsClaim: true },
-                );
-                sendResponse({
-                    error: outcome.error,
-                    retryable: outcome.retryable,
-                    stage: outcome.stage,
+                    stage: TX_STAGE_VERIFY,
                 });
                 return;
             }
@@ -1147,7 +1027,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             try {
                 const provider = getProvider(state.rpcUrl);
                 const tx = await provider.broadcastTransaction(msg.rawSignedTx);
-                if (nonce !== null) spent.add(nonce);
                 settleApproval(
                     msg.id,
                     { txHash: tx.hash },
@@ -1160,11 +1039,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // tell a transaction that never left from one already in the
                 // mempool. The page has been given its outcome for this
                 // request; a second attempt would report a second one.
-                //
-                // Unless the node blamed the nonce, which is the one answer
-                // that says plainly it did not take the transaction:
-                // describeTxFailure() reclassifies that, and the stage it
-                // returns is the one reported.
                 const outcome = describeTxFailure(TX_STAGE_BROADCAST, e);
                 settleApproval(
                     msg.id,
@@ -1174,7 +1048,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: outcome.stage,
+                    stage: TX_STAGE_BROADCAST,
                 });
             }
         })();

src/content/inpage.js

@@ -11,39 +11,6 @@
     let nextId = 1;
     const pending = {};
 
-    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
-    // rather than properties bolted onto an Error because this object crosses
-    // no boundary after construction — it is built in the page's own realm and
-    // handed straight to the caller's catch — so the prototype survives and
-    // `error.name` is a stable thing for a dApp to see.
-    class ProviderRpcError extends Error {
-        constructor(code, message, data) {
-            super(message);
-            this.name = "ProviderRpcError";
-            this.code = code;
-            if (data !== undefined) this.data = data;
-        }
-    }
-
-    // Rebuild a boundary error as the error the page catches, carrying the
-    // code (and data) the extension reported. Without this a dApp cannot tell
-    // a user's refusal (4001) from a wallet that broke, and retries or shows
-    // an error instead of accepting the refusal.
-    //
-    // Whatever code arrived is passed through verbatim rather than being
-    // matched against a list: the extension emits 4001, 4100 and 4902 today,
-    // and a code this file has never heard of is still the truth about what
-    // happened. An error reported with no code at all stays a plain Error —
-    // a ProviderRpcError whose `code` is undefined would advertise a
-    // conformance it does not have. `message` is untouched in every case.
-    function toPageError(error) {
-        const message = (error && error.message) || "Request failed";
-        if (error && error.code !== undefined && error.code !== null) {
-            return new ProviderRpcError(error.code, message, error.data);
-        }
-        return new Error(message);
-    }
-
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -53,7 +20,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
         } else {
             p.resolve(result);
         }

src/popup/index.js

@@ -9,16 +9,17 @@ const {
     $,
     showView,
     updateDebugBanner,
-    setRenderMain,
+    setBackRenderer,
     pushCurrentView,
     goBack,
     clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Views that can be fully re-rendered from persisted state. All others fall
-// back to the nearest restorable parent; see the module for why the
-// secret-bearing views are absent.
-const { RESTORABLE_VIEWS } = require("./restorableViews");
+// Renders a view the popup lands on without having navigated to it forward:
+// on restore here, and on Back. Only the views that can be fully re-rendered
+// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
+// through it; anything else falls back to the nearest restorable parent.
+const { renderView, makeBackRenderer } = require("./viewRouter");
 
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -108,91 +109,22 @@ const ctx = {
     },
 };
 
-function needsAddress(view) {
-    return (
-        view === "address" ||
-        view === "address-token" ||
-        view === "receive" ||
-        view === "transaction"
-    );
-}
-
-function hasValidAddress() {
-    return (
-        state.selectedWallet !== null &&
-        state.selectedAddress !== null &&
-        state.wallets[state.selectedWallet] &&
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
-    );
-}
+// The view modules the router renders through, keyed as it expects them.
+const viewModules = {
+    main: { show: () => fallbackView() },
+    addressDetail,
+    addressToken,
+    receive,
+    settings,
+    settingsAddToken,
+    confirmTx,
+    transactionDetail,
+    txStatus,
+};
 
 function restoreView() {
-    const view = state.currentView;
-    if (!view || !RESTORABLE_VIEWS.has(view)) {
-        return fallbackView();
-    }
-
-    if (needsAddress(view) && !hasValidAddress()) {
-        return fallbackView();
-    }
-
-    if (view === "address-token" && !state.selectedToken) {
-        return fallbackView();
-    }
-
-    switch (view) {
-        case "address":
-            addressDetail.show();
-            break;
-        case "address-token":
-            addressToken.show();
-            break;
-        case "receive":
-            receive.show();
-            break;
-        case "settings":
-            settings.show();
-            break;
-        case "settings-addtoken":
-            settingsAddToken.show();
-            break;
-        case "confirm-tx":
-            if (state.viewData && state.viewData.pendingTx) {
-                confirmTx.restore();
-            } else {
-                fallbackView();
-            }
-            break;
-        case "transaction":
-            if (state.viewData && state.viewData.tx) {
-                transactionDetail.render();
-            } else {
-                fallbackView();
-            }
-            break;
-        case "wait-tx":
-            // Resumes the receipt poll from the persisted broadcast time.
-            if (!txStatus.restoreWait()) {
-                fallbackView();
-            }
-            break;
-        case "success-tx":
-            if (state.viewData && state.viewData.hash) {
-                txStatus.renderSuccess();
-            } else {
-                fallbackView();
-            }
-            break;
-        case "error-tx":
-            if (state.viewData && state.viewData.message) {
-                txStatus.renderError();
-            } else {
-                fallbackView();
-            }
-            break;
-        default:
-            fallbackView();
-            break;
+    if (!renderView(state.currentView, state, viewModules)) {
+        fallbackView();
     }
 }
 
@@ -247,7 +179,7 @@ async function init() {
         settings.show();
     });
 
-    setRenderMain(renderWalletList);
+    setBackRenderer(makeBackRenderer(state, viewModules));
 
     welcome.init(ctx);
     addWallet.init(ctx);

src/popup/viewRouter.js

@@ -0,0 +1,167 @@
+// Rendering a view the popup lands on without having navigated to it
+// forward: on restore, and on Back. In both cases the view may never have
+// been rendered in this page load — a reopened popup renders only the
+// wallet list and the view it restores onto, so every other view is still
+// the blank static template from index.html — so unhiding it is not enough.
+//
+// Forward navigation renders as it goes and must NOT come through here:
+// rendering a second time would re-fetch and clobber whatever the view has
+// in flight.
+//
+// The view modules are injected and nothing here touches the DOM, so the
+// dispatch and its data guards can be tested directly; src/popup/index.js
+// cannot be required outside a browser.
+
+const { RESTORABLE_VIEWS } = require("./restorableViews");
+
+// The views this page load has rendered.
+//
+// The Back path cannot otherwise tell its two cases apart. A view the popup
+// never rendered is still the blank template from index.html and has to be
+// rendered; a view already on the page must NOT be rendered again, because
+// a second render re-fetches and overwrites whatever the user has typed
+// into it and not yet saved.
+//
+// Registration is showView() in views/helpers.js, which is the last thing
+// every render path runs — restoreView()'s, the Back path's, and every
+// forward show(). That is the point of putting it there rather than in the
+// individual views: a view added later registers itself with no one having
+// to remember it, so this cannot decay.
+//
+// Module scope is page-load scope: the popup loads this module once per
+// page load, and a reopened popup gets a fresh, empty set — which is
+// exactly the state that makes the Back path render.
+const renderedViews = new Set();
+
+function markViewRendered(view) {
+    if (view) renderedViews.add(view);
+}
+
+// Begin a fresh page-load scope. The popup gets one by being loaded; the
+// unit tests, which simulate several page loads against one module
+// instance, ask for one.
+function resetRenderedViews() {
+    renderedViews.clear();
+}
+
+// Home is the exception: Back re-renders it every time, which is what the
+// popup did before this router existed (index.js registered
+// renderWalletList() as setRenderMain(), and goBack() called it on every
+// Back onto "main"). It must stay that way — the wallet list has to reflect
+// what changed while the user was away from it, such as a wallet renamed or
+// an address removed in Settings — and Home holds no unsaved input to lose.
+const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
+
+// Views that render an address the user picked and cannot be rendered
+// without one.
+const ADDRESS_VIEWS = new Set([
+    "address",
+    "address-token",
+    "receive",
+    "transaction",
+]);
+
+function needsAddress(view) {
+    return ADDRESS_VIEWS.has(view);
+}
+
+function hasValidAddress(state) {
+    return Boolean(
+        state.selectedWallet !== null &&
+        state.selectedAddress !== null &&
+        state.wallets[state.selectedWallet] &&
+        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
+    );
+}
+
+// Render `view` from persisted state. Each view module shows itself, so a
+// true return means the view is both rendered and on screen.
+//
+// Returns false when the view is not one the popup renders from state, or
+// when the state it would render is gone — a token no longer selected, a
+// transaction no longer persisted. The caller falls back rather than
+// putting an empty template on screen.
+function renderView(view, state, views) {
+    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
+    if (needsAddress(view) && !hasValidAddress(state)) return false;
+    if (view === "address-token" && !state.selectedToken) return false;
+
+    const data = state.viewData || {};
+    switch (view) {
+        case "main":
+            views.main.show();
+            return true;
+        case "address":
+            views.addressDetail.show();
+            return true;
+        case "address-token":
+            views.addressToken.show();
+            return true;
+        case "receive":
+            views.receive.show();
+            return true;
+        case "settings":
+            views.settings.show();
+            return true;
+        case "settings-addtoken":
+            views.settingsAddToken.show();
+            return true;
+        case "confirm-tx":
+            if (!data.pendingTx) return false;
+            views.confirmTx.restore();
+            return true;
+        case "transaction":
+            if (!data.tx) return false;
+            views.transactionDetail.render();
+            return true;
+        case "wait-tx":
+            // Resumes the receipt poll from the persisted broadcast time,
+            // and answers false when there is nothing resumable left.
+            return Boolean(views.txStatus.restoreWait());
+        case "success-tx":
+            if (!data.hash) return false;
+            views.txStatus.renderSuccess();
+            return true;
+        case "error-tx":
+            if (!data.message) return false;
+            views.txStatus.renderError();
+            return true;
+        default:
+            return false;
+    }
+}
+
+// The Back-path renderer, registered with setBackRenderer() in
+// views/helpers.js.
+//
+// Returns false — leaving goBack() to unhide the view, as it always did —
+// in the two cases where the view is known to be on the page already:
+//
+//   - It is not one the popup renders from persisted state. The restored
+//     stack is filtered against RESTORABLE_VIEWS, so such a view can only
+//     be on the stack from this page load, where forward navigation
+//     rendered it on the way in.
+//   - This page load has rendered it. Re-rendering would re-fetch and
+//     clobber what it holds; Home is rendered anyway, see above.
+//
+// What is left is the case the router exists for: a view on the stack that
+// this page load has never rendered, whose template is still blank.
+function makeBackRenderer(state, views) {
+    return function renderBack(view) {
+        if (!RESTORABLE_VIEWS.has(view)) return false;
+        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
+            return false;
+        }
+        if (!renderView(view, state, views)) {
+            views.main.show();
+        }
+        return true;
+    };
+}
+
+module.exports = {
+    renderView,
+    makeBackRenderer,
+    markViewRendered,
+    resetRenderedViews,
+};

src/popup/views/helpers.js

@@ -7,6 +7,7 @@ const {
     getAddressValueUsd,
 } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
+const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -76,6 +77,10 @@ function showView(name) {
     }
     clearFlash();
     state.currentView = name;
+    // A view's show() ends here, so this is where the Back path learns the
+    // view is no longer the blank template from index.html and must not be
+    // rendered a second time. See viewRouter.js.
+    markViewRendered(name);
     saveState();
     updateDebugBanner(name);
 }
@@ -111,12 +116,19 @@ function updateDebugBanner(viewName) {
     }
 }
 
-// Callback to re-render the main/home view when navigating back to it.
-// Set once by index.js via setRenderMain().
-let _renderMain = null;
+// Callback that renders a view being navigated BACK onto. Set once by
+// index.js via setBackRenderer(), which routes the view through the same
+// per-view render and data guards restoreView() uses.
+//
+// It answers true when it took the navigation — the view is rendered and
+// shown, or its backing data was gone and it fell back — and false for a
+// view the popup does not render from persisted state. Those can only be
+// on the stack from this page load, because the stack is filtered on load,
+// so they have already been rendered and only need unhiding.
+let _renderBack = null;
 
-function setRenderMain(fn) {
-    _renderMain = fn;
+function setBackRenderer(fn) {
+    _renderBack = fn;
 }
 
 // Push the current view onto the navigation stack so goBack() can
@@ -136,9 +148,11 @@ function goBack() {
     } else {
         target = "main";
     }
-    if (target === "main" && _renderMain) {
-        _renderMain();
-    }
+    // A popped view is landed on, not navigated to. If the popup has been
+    // closed and reopened since the view was pushed, nothing has ever
+    // rendered it in this page load and its template is still blank, so it
+    // has to be rendered here rather than merely unhidden.
+    if (_renderBack && _renderBack(target)) return;
     showView(target);
 }
 
@@ -470,7 +484,7 @@ module.exports = {
     showView,
     onViewLeave,
     updateDebugBanner,
-    setRenderMain,
+    setBackRenderer,
     pushCurrentView,
     goBack,
     clearViewStack,

src/shared/approvalVerify.js

@@ -602,12 +602,6 @@ const TX_STAGE_BROADCAST = "broadcast";
 // may yet succeed, so the one thing the popup must not say is "start again
 // from the site".
 const TX_STAGE_INFLIGHT = "inflight";
-// A transaction refused for a nonce that is already spoken for, either by the
-// node's own answer or by this wallet's record of what it has broadcast. It is
-// the one broadcast-stage failure that is not ambiguous: the transaction was
-// not taken, so the user is told it did not reach the network and to send it
-// again, rather than being warned that it might already be out there.
-const TX_STAGE_NONCE = "nonce";
 
 function errorText(err) {
     if (typeof err === "string" && err !== "") return err;
@@ -617,59 +611,6 @@ function errorText(err) {
     return "The transaction could not be sent.";
 }
 
-// Every string a failure might carry its reason in. ethers reports the node's
-// own words in `shortMessage`, but a JSON-RPC error it could not classify is
-// nested under `error` or `info.error` with the node's message intact, and the
-// classification below has to see that too.
-function failureTexts(err) {
-    if (typeof err === "string") return [err];
-    if (!err || typeof err !== "object") return [];
-    const texts = [];
-    for (const text of [err.shortMessage, err.message, err.reason]) {
-        if (text) texts.push(String(text));
-    }
-    const nested = err.error || (err.info && err.info.error);
-    if (nested && nested.message) texts.push(String(nested.message));
-    return texts;
-}
-
-// What the Ethereum clients say when a transaction's nonce is already spoken
-// for: either it is below the account's next nonce, or another transaction is
-// sitting in the pool at that nonce and this one did not outbid it. Either way
-// the node answered, and its answer was that it did not take this transaction.
-//
-// "already known" is deliberately absent. A node that says it knows the
-// transaction has it, so that transaction did reach the network and the
-// ambiguous broadcast wording is the correct one for it.
-const NONCE_COLLISION_PATTERNS = [
-    /nonce too low/i,
-    /nonce has already been used/i,
-    /invalid nonce/i,
-    /oldnonce/i,
-    /replacement transaction underpriced/i,
-    /replacement fee too low/i,
-];
-
-// ethers' own classification of the same two conditions.
-const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
-
-// Whether a failed send is a nonce collision.
-function isNonceCollision(err) {
-    if (!err) return false;
-    if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
-    return failureTexts(err).some((text) =>
-        NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
-    );
-}
-
-// What both the requesting page and the popup are told about a nonce
-// collision. The node's own words ("nonce too low") are a fragment and are
-// replaced rather than passed through: they are not a sentence, and they say
-// less than the wallet knows.
-const NONCE_COLLISION_MESSAGE =
-    "The transaction was not sent, because its nonce had already been used" +
-    " by another transaction.";
-
 // What the background does with a pending transaction approval after a failed
 // attempt: what it tells the popup, and whether the approval is spent
 // (resolved to the requesting page as an error and deleted) or left standing
@@ -686,31 +627,12 @@ const NONCE_COLLISION_MESSAGE =
 //    that never left from one that is already in the mempool. The approval is
 //    spent and the requesting page has been given its outcome; a second
 //    attempt against it would report a second outcome for one request.
-//  - nonce: terminal too, and the one case where the wallet does know the
-//    transaction never left. The approval carries a nonce that is spent, so
-//    the artifact signed against it can never be accepted and the user is told
-//    to send it again from the site.
-//
-// The stage comes back out because a broadcast failure the node blamed on the
-// nonce is reclassified here; the caller reports the stage this returns rather
-// than the one it passed in.
 function describeTxFailure(stage, err) {
-    if (
-        stage === TX_STAGE_NONCE ||
-        (stage === TX_STAGE_BROADCAST && isNonceCollision(err))
-    ) {
-        return {
-            error: NONCE_COLLISION_MESSAGE,
-            retryable: false,
-            spendApproval: true,
-            stage: TX_STAGE_NONCE,
-        };
-    }
     const error = errorText(err);
     const retryable =
         stage === TX_STAGE_SIGN ||
         (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
-    return { error, retryable, spendApproval: !retryable, stage };
+    return { error, retryable, spendApproval: !retryable };
 }
 
 // What the popup shows and does after the background reports a failed signing
@@ -720,20 +642,14 @@ function describeTxFailure(stage, err) {
 //
 // A failed broadcast gets its own wording: the transaction may already be on
 // the network, so telling the user to start again from the site is exactly the
-// wrong instruction. A nonce collision is the exception to that exception —
-// the transaction demonstrably did not go out, and saying it might have would
-// send the user hunting for a transaction that does not exist.
+// wrong instruction.
 function describeSigningFailure(response, fallbackMessage) {
     let message = (response && response.error) || fallbackMessage;
     if (!/[.!?]$/.test(message)) message += ".";
     const retryable = !!(response && response.retryable);
     const stage = response && response.stage;
     if (!retryable) {
-        if (stage === TX_STAGE_NONCE) {
-            message +=
-                " The transaction did not reach the network." +
-                " Please send it again from the site.";
-        } else if (stage === TX_STAGE_BROADCAST) {
+        if (stage === TX_STAGE_BROADCAST) {
             message +=
                 " The transaction may still have reached the network." +
                 " Check the account before sending it again.";
@@ -759,11 +675,9 @@ module.exports = {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
-    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
     ApprovalMismatchError,
-    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -772,7 +686,6 @@ module.exports = {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
-    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 };

src/shared/symbolSpoof.js

@@ -8,19 +8,12 @@
 // either verdict alone, because the balance list is where the user forms
 // their belief about what they own (issue #235).
 //
-// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
-// that may bear it, or to null.  Null means the symbol belongs to the native
-// asset, which has no contract at all, so no contract may bear it and every
-// one that does is a spoof.  "ETH" is the only such entry today; the rule is
+// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
+// bear it, or to null.  Null means the symbol belongs to the native asset,
+// which has no contract at all, so no contract may bear it and every one
+// that does is a spoof.  "ETH" is the only such entry today; the rule is
 // written so that a second one needs no change here or at any call site.
 //
-// The value is a set because a ticker is not unique: seven symbols in the
-// bundled list belong to two real contracts each, and answering with one of
-// them hid the other one's holders' money (issue #276).  Membership, not
-// equality, is therefore the question — but it is the same question, asked of
-// a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token; a contract outside the set is still a spoof.
-//
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
 // question is whether the symbol reaches the user's eye as a known one,
@@ -100,7 +93,7 @@ function isSpoofedSymbol(symbol, contractAddress) {
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
-    return !legit.has(contract);
+    return contract !== normalizeAddress(legit);
 }
 
 module.exports = {

src/shared/tokenList.js

@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// Build a map of symbol (uppercased) -> the set of contract addresses
-// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
-// "ETH" maps to null: the native asset has no contract, so no contract may
-// bear its symbol.
-//
-// The value is a set and not a single address because tickers are not unique
-// and the list above proves it: seven of these 512 tokens share a symbol with
-// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
-// different real contracts each, all of them from the same source fetch.  A
-// one-address-per-symbol table can only answer that by picking a winner, and
-// the loser is then a token in our own bundled list that the spoof filter
-// hides from the balance list, the history and the send selector at its own
-// address, so the user cannot spend it (issue #276).  Naming every address
-// that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule, because a contract outside the set is still a spoof.
+// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
+// Used for spoofed-symbol detection. "ETH" maps to null (native token).
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
     const upper = t.symbol.toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, new Set());
-    }
-    const addresses = KNOWN_SYMBOLS.get(upper);
-    // A null entry is the native asset and stays null: an ERC-20 that reports
-    // the native symbol does not thereby become entitled to it.
-    if (addresses !== null) {
-        addresses.add(t.address.toLowerCase());
+        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
     }
 }
 

tests/approvalVerify.test.js

@@ -14,10 +14,8 @@ const {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
-    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
-    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -25,7 +23,6 @@ const {
     TX_STAGE_SIGN,
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
-    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 } = require("../src/shared/approvalVerify");
@@ -1194,6 +1191,7 @@ describe("signing failure and retry", () => {
             "already known",
             "timeout of 30000ms exceeded",
             "could not coalesce error",
+            "replacement transaction underpriced",
         ]) {
             const outcome = describeTxFailure(
                 TX_STAGE_BROADCAST,
@@ -1201,76 +1199,10 @@ describe("signing failure and retry", () => {
             );
             expect(outcome.retryable).toBe(false);
             expect(outcome.spendApproval).toBe(true);
-            expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
             expect(outcome.error).toBe(message);
         }
     });
 
-    // The one broadcast failure that is not ambiguous. The node answered, and
-    // its answer was that the nonce was already spoken for, so this
-    // transaction is not in a mempool anywhere.
-    test("a nonce the node refused is classified however it was worded", () => {
-        for (const err of [
-            new Error("nonce too low"),
-            new Error("replacement transaction underpriced"),
-            Object.assign(new Error("could not coalesce error"), {
-                code: "NONCE_EXPIRED",
-            }),
-            Object.assign(new Error("could not coalesce error"), {
-                code: "REPLACEMENT_UNDERPRICED",
-            }),
-            // The shape ethers hands up when it could not classify the node's
-            // error itself: the node's own words are nested underneath.
-            Object.assign(new Error("could not coalesce error"), {
-                info: { error: { code: -32000, message: "OldNonce" } },
-            }),
-        ]) {
-            const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
-            expect(
-                describeSigningFailure(
-                    outcome,
-                    "The transaction could not be sent.",
-                ).message,
-            ).toMatch(/did not reach the network/);
-            expect(outcome.retryable).toBe(false);
-            expect(outcome.spendApproval).toBe(true);
-            expect(outcome.error).toBe(NONCE_COLLISION_MESSAGE);
-            expect(outcome.stage).toBe(TX_STAGE_NONCE);
-            expect(isNonceCollision(err)).toBe(true);
-        }
-    });
-
-    // A node that says it knows the transaction has it, so it did reach the
-    // network and the ambiguous wording is the correct one.
-    test("already known is not a nonce collision", () => {
-        const err = new Error("already known");
-        const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
-        expect(
-            describeSigningFailure(
-                outcome,
-                "The transaction could not be sent.",
-            ).message,
-        ).toMatch(/may still have reached the network/);
-        expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
-        expect(isNonceCollision(err)).toBe(false);
-    });
-
-    test("a nonce collision says the transaction did not reach the network", () => {
-        const outcome = describeTxFailure(
-            TX_STAGE_BROADCAST,
-            new Error("nonce too low"),
-        );
-        const copy = describeSigningFailure(
-            outcome,
-            "The transaction could not be sent.",
-        );
-        expect(copy.retryable).toBe(false);
-        expect(copy.message).toMatch(/did not reach the network/);
-        expect(copy.message).not.toMatch(/may still have reached the network/);
-        expect(copy.message).toMatch(/Please send it again from the site\.$/);
-        expect(copy.message).toMatch(/^[A-Z].*\.$/);
-    });
-
     test("a failed broadcast does not tell the user to send it again", () => {
         const outcome = describeSigningFailure(
             {

tests/backNavigation.test.js

@@ -0,0 +1,329 @@
+// Back after reopening the popup (#268).
+//
+// A reopened popup renders the wallet list and the one view it restores
+// onto; every other view is still the blank static template from
+// index.html. goBack() used to only unhide its target, so Back landed on
+// that blank template for any view the popup had not rendered in this page
+// load. These tests drive the real goBack() with the real router wired to
+// recording view modules, so what is asserted is which view render ran —
+// the thing that was missing.
+//
+// The rendering itself is asserted against the real popup in a real
+// browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
+// only needs showView() to work.
+
+const els = new Map();
+
+function fakeEl() {
+    return {
+        textContent: "",
+        innerHTML: "",
+        classList: {
+            toggle() {},
+            add() {},
+            remove() {},
+            contains: () => false,
+        },
+        remove() {},
+    };
+}
+
+globalThis.document = {
+    getElementById(id) {
+        if (!els.has(id)) els.set(id, fakeEl());
+        return els.get(id);
+    },
+};
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const {
+    showView,
+    goBack,
+    setBackRenderer,
+    pushCurrentView,
+} = require("../src/popup/views/helpers");
+const {
+    makeBackRenderer,
+    markViewRendered,
+    resetRenderedViews,
+} = require("../src/popup/viewRouter");
+const { state } = require("../src/shared/state");
+
+const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+
+let calls;
+
+// Stand-ins for the view modules. Each records itself and then shows its
+// view, which is what every real view render ends with — so the assertions
+// can tell "rendered and shown" apart from "merely unhidden".
+function recorder(name, view) {
+    return () => {
+        calls.push(name);
+        showView(view);
+    };
+}
+
+function makeViews() {
+    return {
+        main: { show: recorder("main", "main") },
+        addressDetail: { show: recorder("addressDetail", "address") },
+        addressToken: { show: recorder("addressToken", "address-token") },
+        receive: { show: recorder("receive", "receive") },
+        settings: { show: recorder("settings", "settings") },
+        settingsAddToken: {
+            show: recorder("settingsAddToken", "settings-addtoken"),
+        },
+        confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
+        transactionDetail: {
+            render: recorder("transactionDetail", "transaction"),
+        },
+        txStatus: {
+            restoreWait: () => {
+                calls.push("waitTx");
+                showView("wait-tx");
+                return true;
+            },
+            renderSuccess: recorder("successTx", "success-tx"),
+            renderError: recorder("errorTx", "error-tx"),
+        },
+    };
+}
+
+// The popup as it stands just after a reopen: one wallet with one address,
+// the view the popup restored onto, and the stack behind it.
+//
+// A reopen is a fresh page load, so the record of what has been rendered
+// starts empty — that emptiness is what makes the Back path render at all.
+// Returns the view modules so a test can drive forward navigation through
+// the same recorders the router renders through.
+function reopenedOn(view, stack, extra) {
+    calls = [];
+    resetRenderedViews();
+    state.wallets = [
+        {
+            name: "Wallet 1",
+            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
+        },
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    state.selectedToken = null;
+    state.viewData = null;
+    state.currentView = view;
+    state.viewStack = stack.slice();
+    Object.assign(state, extra || {});
+    // Restoring onto a view renders it, so the reopened popup has that one
+    // view on the page and nothing else.
+    markViewRendered(view);
+    const views = makeViews();
+    setBackRenderer(makeBackRenderer(state, views));
+    return views;
+}
+
+// The reproduction from the issue, step for step.
+describe("Back onto a view the reopened popup never rendered", () => {
+    test("Back from settings renders the address detail underneath", () => {
+        reopenedOn("settings", ["main", "address"]);
+        goBack();
+        expect(calls).toEqual(["addressDetail"]);
+        expect(state.currentView).toBe("address");
+        expect(state.viewStack).toEqual(["main"]);
+    });
+
+    test("Back onto the token detail renders it", () => {
+        reopenedOn("settings", ["main", "address", "address-token"], {
+            selectedToken: TOKEN,
+        });
+        goBack();
+        expect(calls).toEqual(["addressToken"]);
+        expect(state.currentView).toBe("address-token");
+    });
+
+    test("Back onto Receive renders it", () => {
+        reopenedOn("settings", ["main", "address", "receive"]);
+        goBack();
+        expect(calls).toEqual(["receive"]);
+        expect(state.currentView).toBe("receive");
+    });
+
+    test("Back onto the transaction detail renders it", () => {
+        reopenedOn("settings", ["main", "transaction"], {
+            viewData: { tx: { hash: "0xdead" } },
+        });
+        goBack();
+        expect(calls).toEqual(["transactionDetail"]);
+        expect(state.currentView).toBe("transaction");
+    });
+
+    test("Back onto the transaction confirmation restores it", () => {
+        reopenedOn("settings", ["main", "confirm-tx"], {
+            viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
+        });
+        goBack();
+        expect(calls).toEqual(["confirmTx"]);
+        expect(state.currentView).toBe("confirm-tx");
+    });
+
+    test("Back onto the success screen renders it", () => {
+        reopenedOn("settings", ["main", "success-tx"], {
+            viewData: { hash: "0xdead" },
+        });
+        goBack();
+        expect(calls).toEqual(["successTx"]);
+        expect(state.currentView).toBe("success-tx");
+    });
+
+    test("Back onto the failure screen renders it", () => {
+        reopenedOn("settings", ["main", "error-tx"], {
+            viewData: { message: "execution reverted" },
+        });
+        goBack();
+        expect(calls).toEqual(["errorTx"]);
+        expect(state.currentView).toBe("error-tx");
+    });
+
+    test("Back onto Home renders the wallet list", () => {
+        reopenedOn("settings", ["main"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("Back with an empty stack renders Home", () => {
+        reopenedOn("settings", []);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});
+
+// The guards are restoreView()'s, so a popped view whose backing data is
+// gone lands on Home rather than on an empty template.
+describe("Back onto a view whose backing data is gone", () => {
+    test("the token detail with no token selected falls back to Home", () => {
+        reopenedOn("settings", ["main", "address-token"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the transaction detail with no transaction falls back to Home", () => {
+        reopenedOn("settings", ["main", "transaction"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the confirmation with no pending transaction falls back to Home", () => {
+        reopenedOn("settings", ["main", "confirm-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("an address view with no address selected falls back to Home", () => {
+        reopenedOn("settings", ["main", "receive"], {
+            selectedAddress: null,
+        });
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the success screen with no transaction hash falls back to Home", () => {
+        reopenedOn("settings", ["main", "success-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the failure screen with no message falls back to Home", () => {
+        reopenedOn("settings", ["main", "error-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("a wait that can no longer be resumed falls back to Home", () => {
+        reopenedOn("settings", ["main", "wait-tx"]);
+        const views = makeViews();
+        views.txStatus.restoreWait = () => false;
+        setBackRenderer(makeBackRenderer(state, views));
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});
+
+// Forward navigation renders as it goes, and a second render would re-fetch
+// and clobber whatever the view holds — an unsaved edit, a request in
+// flight. So the Back path renders only a view this page load has never
+// rendered, and merely unhides every other one: the views it does not
+// render from persisted state, and the views already on the page.
+describe("what the Back path leaves alone", () => {
+    test("forward navigation renders nothing by itself", () => {
+        reopenedOn("address", ["main"]);
+        pushCurrentView();
+        showView("send");
+        expect(calls).toEqual([]);
+        expect(state.viewStack).toEqual(["main", "address"]);
+    });
+
+    test("Back onto a live-session view only unhides it", () => {
+        reopenedOn("confirm-tx", ["main", "address", "send"]);
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("send");
+    });
+
+    test("Back renders its target exactly once", () => {
+        reopenedOn("settings", ["main", "address"]);
+        goBack();
+        expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
+    });
+
+    test("Back onto a view this page load already rendered only unhides it", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.addressDetail.show();
+        pushCurrentView();
+        views.settings.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("address");
+    });
+
+    // The unit mirror of the regression the browser suite pins: Settings
+    // reassigns its fields from persisted state on every render, so a
+    // re-render on the way back discards an edit the user has not saved.
+    test("Back onto Settings visited earlier in this page load does not re-render it", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.settings.show();
+        pushCurrentView();
+        views.settingsAddToken.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("settings");
+    });
+
+    // Home is the deliberate exception, unchanged from the popup's
+    // behaviour before the router existed: it re-renders on every Back so
+    // the wallet list reflects what changed while the user was away.
+    test("Back onto Home renders it again even when it is already on the page", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.addressDetail.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});

tests/backgroundApproval.test.js

@@ -206,10 +206,6 @@ function loadBackground(options) {
     // approval id back out of the popup URL the background opened.
     function requestTx(txParams) {
         let rpcResult = null;
-        // The window this request opens, if it opens one. A request refused
-        // before an approval is raised opens none, and the window belonging to
-        // some other request must not be handed back as this one's.
-        const windowIndex = created.length;
         const sendResponse = jest.fn((r) => {
             rpcResult = r;
         });
@@ -223,12 +219,7 @@ function loadBackground(options) {
             sendResponse,
         );
         return {
-            id: () =>
-                created.length > windowIndex
-                    ? new URL(created[windowIndex].url).searchParams.get(
-                          "approval",
-                      )
-                    : null,
+            id: () => new URL(created[0].url).searchParams.get("approval"),
             result: () => rpcResult,
         };
     }
@@ -453,176 +444,6 @@ describe("one approval, one broadcast", () => {
     });
 });
 
-// Populating the transaction before the approval window opens is what makes
-// the displayed object the verified object. It also fixes the nonce before the
-// user has answered anything: two requests populated concurrently take the
-// same nonce from a node that has seen neither of them broadcast, and the
-// second can then never be sent, because the only way to give it a fresh nonce
-// is to populate it again after the user has read the old one off the screen.
-// So the second request is refused while the first is unanswered.
-describe("one transaction approval at a time", () => {
-    test("a second eth_sendTransaction while one is pending is refused before it takes a nonce", async () => {
-        const getTransactionCount = jest.fn(async () => NONCE);
-        const bg = loadBackground({ provider: { getTransactionCount } });
-
-        const first = bg.requestTx();
-        await settle();
-        expect(first.id()).toBeTruthy();
-        expect(getTransactionCount).toHaveBeenCalledTimes(1);
-
-        const second = bg.requestTx();
-        await settle();
-
-        expect(second.result()).toEqual({
-            error: {
-                code: -32002,
-                message: expect.stringMatching(
-                    /already waiting to be approved/,
-                ),
-            },
-        });
-        // Where the refusal happened matters as much as that it happened: no
-        // second window, and the node was never asked for a second nonce.
-        expect(bg.created).toHaveLength(1);
-        expect(getTransactionCount).toHaveBeenCalledTimes(1);
-
-        // The refusal leaves the pending approval untouched, and it still
-        // sends.
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: first.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(first.result()).toEqual({ result: "0xfeed" });
-    });
-
-    test("an answered approval frees the next request", async () => {
-        const bg = loadBackground();
-        const first = bg.requestTx();
-        await settle();
-
-        // The user closes the approval window, which rejects it.
-        bg.closeWindow(1);
-        await settle();
-        expect(first.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-
-        const second = bg.requestTx();
-        await settle();
-        expect(second.id()).toBeTruthy();
-        expect(bg.created).toHaveLength(2);
-    });
-
-    test("a signature request is not held up by a pending transaction", async () => {
-        const bg = loadBackground();
-        bg.requestTx();
-        await settle();
-
-        // A signature consumes no nonce, so it has nothing to collide with.
-        const signing = bg.requestSign();
-        await settle();
-        expect(signing.id()).toBeTruthy();
-        expect(signing.result()).toBeNull();
-        expect(bg.created).toHaveLength(2);
-    });
-});
-
-// A nonce collision found before the transaction reaches the network is the
-// one send failure the wallet can speak about with certainty. The user is told
-// it did not go out and to send it again, rather than being warned it might
-// already be on the chain — which would send them looking for a transaction
-// that does not exist, and stop them retrying the one that never went.
-describe("a nonce collision is reported as a transaction that did not go out", () => {
-    test("a broadcast the node refused for the nonce is not reported as possibly sent", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        bg.broadcastTransaction.mockRejectedValue(
-            Object.assign(new Error("nonce too low"), {
-                code: "NONCE_EXPIRED",
-            }),
-        );
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: expect.stringMatching(/nonce had already been used/),
-            retryable: false,
-            stage: "nonce",
-        });
-        expect(pending.result()).toEqual({
-            error: {
-                message: expect.stringMatching(
-                    /transaction was not sent, because its nonce/,
-                ),
-            },
-        });
-    });
-
-    test("a nonce this wallet already broadcast is refused without asking the node again", async () => {
-        const bg = loadBackground();
-        const first = bg.requestTx();
-        await settle();
-
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: first.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(first.result()).toEqual({ result: "0xfeed" });
-
-        // The stubbed node still reports NONCE as the next nonce — a pending
-        // count that lags a broadcast the node has already taken — so this
-        // second approval is populated at a nonce this worker has spent.
-        const second = bg.requestTx();
-        await settle();
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: second.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-
-        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: expect.stringMatching(/nonce had already been used/),
-            retryable: false,
-            stage: "nonce",
-        });
-        expect(second.result()).toEqual({
-            error: {
-                message: expect.stringMatching(/nonce had already been used/),
-            },
-        });
-    });
-});
-
 // The approval carries the transaction the user was shown and the address it
 // was raised for, and the artifact is checked against both. Every case here is
 // one the old comparison — against the dApp's request, for the address that is

tests/e2e/network.js

@@ -86,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records the whole observable shape of the error as it
-// arrives — name, message, and whether a `code` is present at all as distinct
-// from its value. EIP-1193 says a user rejection is a ProviderRpcError
-// carrying code 4001; what the page can actually see is recorded here rather
-// than assumed, and asserted in run.js.
+// The rejection branch records `code` as it arrives. EIP-1193 says a user
+// rejection is a ProviderRpcError carrying code 4001; what the page can
+// actually see is recorded here rather than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -122,7 +120,6 @@ const DAPP_HTML = [
     "                    return {",
     "                        settled: 'rejected',",
     "                        message: String((error && error.message) || error),",
-    "                        name: error ? error.name : undefined,",
     "                        hasCode: !!error && 'code' in Object(error),",
     "                        code: error ? error.code : undefined,",
     "                    };",

tests/e2e/run.js

@@ -419,6 +419,172 @@ test("reopening the popup never lands on the phrase screen (#161)", async (env)
     assertWiped(st, env.phrase, "after reopening the popup");
 });
 
+// ------------------------------- Back after reopening the popup (#268)
+
+// A reopened popup renders the wallet list and the view it restores onto,
+// and nothing else: every other screen is still the blank static template
+// from index.html. Back used to only unhide its target, which is why these
+// have to run against the real popup — the template is present and
+// well-formed, so only its emptiness distinguishes the defect, and only a
+// real reopen produces it.
+
+// Everything the address screen must have on it, read out of the DOM.
+function addressScreenState(page) {
+    return page.evaluate(() => {
+        const line = document.getElementById("address-line");
+        const balances = document.getElementById("address-balances");
+        return {
+            hidden: document
+                .getElementById("view-address")
+                .classList.contains("hidden"),
+            line: line ? line.innerText.trim() : "",
+            balances: balances ? balances.innerText.trim() : "",
+        };
+    });
+}
+
+// Close and reopen the page rather than reload it: that is what the toolbar
+// popup does, and it is the only thing that produces the unrendered views.
+async function reopenPopup(env, restoredView) {
+    await env.page.close();
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, restoredView);
+}
+
+// The reproduction from the issue, step for step.
+test("Back after reopening the popup renders the address screen (#268)", async (env) => {
+    await openAddressDetail(env.page);
+    const before = await addressScreenState(env.page);
+    assert(
+        before.line.length > 0,
+        "the address screen was blank to begin with",
+    );
+
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    await reopenPopup(env, "#view-settings");
+
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
+    const after = await addressScreenState(env.page);
+    assert(
+        after.line === before.line,
+        "the address line reads " +
+            JSON.stringify(after.line) +
+            ", expected " +
+            JSON.stringify(before.line),
+    );
+    assert(
+        after.balances.includes("ETH"),
+        "the balances read " + JSON.stringify(after.balances),
+    );
+});
+
+// The same defect one screen further in. Receive holds the address twice
+// over — as text and as the QR code the sender scans — and a blank one is
+// worse than a missing screen.
+// Everything the Receive screen must have on it. The QR code is read as
+// pixels, not as an element: the blank template carries the canvas too, a
+// default 300x150 one with nothing drawn on it and every pixel fully
+// transparent. A drawn QR paints an opaque background across the whole
+// canvas, so a single opaque pixel is the whole question.
+function receiveScreenState(page) {
+    return page.evaluate(() => {
+        const block = document.getElementById("receive-address-block");
+        const canvas = document.getElementById("receive-qr");
+        const px = canvas
+            .getContext("2d")
+            .getImageData(0, 0, canvas.width, canvas.height).data;
+        let opaque = 0;
+        for (let i = 3; i < px.length; i += 4) {
+            if (px[i] > 0) opaque += 1;
+        }
+        return {
+            address: block.dataset.full || "",
+            text: block.innerText.trim(),
+            qrOpaquePixels: opaque,
+        };
+    });
+}
+
+test("Back after reopening the popup renders the Receive screen (#268)", async (env) => {
+    await openAddressDetail(env.page);
+    await env.page.click("#btn-receive");
+    await visible(env.page, "#view-receive");
+    const before = await receiveScreenState(env.page);
+    assert(
+        /^0x[0-9a-fA-F]{40}$/.test(before.address),
+        "Receive showed no address to begin with: " +
+            JSON.stringify(before.address),
+    );
+
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    await reopenPopup(env, "#view-settings");
+
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-receive");
+
+    const shown = await receiveScreenState(env.page);
+    assert(
+        shown.address === before.address,
+        "Receive shows " +
+            JSON.stringify(shown.address) +
+            ", expected " +
+            JSON.stringify(before.address),
+    );
+    assert(
+        shown.text.includes(before.address),
+        "the Receive address is not on screen: " + JSON.stringify(shown.text),
+    );
+    assert(shown.qrOpaquePixels > 0, "Receive shows an unpainted QR code");
+
+    // Leave the suite where it found it.
+    await env.page.click("#btn-receive-back");
+    await visible(env.page, "#view-address");
+    await env.page.click("#btn-address-back");
+    await visible(env.page, "#view-main");
+});
+
+// The other half of the requirement: Back renders a screen this page load
+// never rendered, and must NOT re-render one it already has on screen.
+// settings.show() reassigns #settings-rpc from persisted state, so
+// re-rendering Settings on the way back would silently revert whatever the
+// user typed and had not saved yet — and they could then press Save and
+// store the value they believed they had replaced. No reopen here: this is
+// an ordinary in-session forward-and-back, which is exactly why the render
+// must not happen.
+test("Back onto Settings keeps unsaved input (#268)", async (env) => {
+    await visible(env.page, "#view-main");
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    const typed = "https://rpc.example.invalid/unsaved";
+    await env.page.fill("#settings-rpc", typed);
+
+    await env.page.click("#btn-settings-add-token");
+    await visible(env.page, "#view-settings-addtoken");
+    await env.page.click("#btn-settings-addtoken-back");
+    await visible(env.page, "#view-settings");
+
+    const kept = await env.page.inputValue("#settings-rpc");
+    assert(
+        kept === typed,
+        "the unsaved RPC URL reads " +
+            JSON.stringify(kept) +
+            ", expected " +
+            JSON.stringify(typed),
+    );
+
+    // Leave the suite where it found it. The typed value was never saved,
+    // and Settings reloads the field from state next time it renders.
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-main");
+});
+
 // -------------------------------------------- address removal (#162)
 
 // Number of address rows across every wallet in the list, counted in the DOM
@@ -1591,14 +1757,15 @@ async function lastResponseError(page) {
 }
 
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and EIP-1193 code 4001 is present both
-// on the wire and on the Error the calling page catches.
+// rather than hanging or resolving, and the response that crossed the
+// boundary carried EIP-1193 code 4001.
 //
-// Both ends matter because they used to disagree. The code crossed the
-// boundary correctly and src/content/inpage.js then threw it away, rebuilding
-// every rejection as `new Error(error.message)` — so a dApp branching on
-// `err.code === 4001` saw undefined and could not tell a refusal from a
-// failure (#274). Asserting only the wire would leave that gap invisible.
+// The code is asserted on the wire because that is the only place it
+// survives. src/content/inpage.js rebuilds the rejection as `new
+// Error(error.message)`, so the Error the calling page catches carries the
+// message and no code. That is reported rather than asserted either way —
+// locking in the current behaviour would make the gap permanent, and
+// asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
     const outcome = await settleRequest(page, key);
     assert(
@@ -1620,32 +1787,15 @@ async function assertUserRejection(page, key, label) {
             " did not carry EIP-1193 code 4001 across the boundary: " +
             JSON.stringify(error),
     );
-    assert(
-        outcome.hasCode,
-        label +
-            " reached the page as an error with no code property at all, so a " +
-            "dApp cannot tell the user's refusal from a failure: " +
-            JSON.stringify(outcome),
-    );
-    assert(
-        outcome.code === 4001,
-        label +
-            " reached the page with code " +
-            JSON.stringify(outcome.code) +
-            " rather than EIP-1193 4001",
-    );
-    assert(
-        outcome.name === "ProviderRpcError",
-        label +
-            " reached the page as " +
-            JSON.stringify(outcome.name) +
-            " rather than an EIP-1193 ProviderRpcError",
-    );
     console.log(
         "# " +
             label +
-            ": code 4001 on the wire and on the page's " +
-            outcome.name,
+            ": boundary code=" +
+            error.code +
+            " page Error.code=" +
+            JSON.stringify(outcome.code) +
+            " page Error carries a code=" +
+            outcome.hasCode,
     );
     return outcome;
 }

tests/inpageErrors.test.js

@@ -1,310 +0,0 @@
-// The EIP-1193 error the page actually catches (src/content/inpage.js).
-//
-// The bug this pins down (issue #274): the provider rebuilt every failure as
-// `new Error(error.message)`, so the `code` the background produced and the
-// content script relayed intact was thrown away in the last hop. A dApp
-// checking `err.code === 4001` — the standard way to tell "the user said no"
-// from "the wallet broke" — saw undefined, and well-behaved sites showed an
-// error or retried instead of accepting the refusal.
-//
-// inpage.js is a bare IIFE injected into the page's JS context, not a module:
-// it takes no import and exports nothing, and reaches for `window` at load.
-// So it is evaluated here the way the browser evaluates it, against a stub
-// window, and the provider is collected from `window.ethereum`. The globals it
-// touches are passed in as function parameters rather than assigned to
-// globalThis: nothing leaks between tests, and the source is compiled in this
-// realm, so the errors it constructs are comparable against this file's own
-// `Error` — which a second realm's intrinsics would silently defeat.
-//
-// There is no jsdom in this repo; see tests/txStatus.test.js.
-
-const fs = require("fs");
-const path = require("path");
-const { webcrypto } = require("crypto");
-
-const SOURCE = fs.readFileSync(
-    path.join(__dirname, "..", "src", "content", "inpage.js"),
-    "utf8",
-);
-
-const loadInto = new Function(
-    "window",
-    "self",
-    "crypto",
-    "Event",
-    "CustomEvent",
-    SOURCE,
-);
-
-class StubEvent {
-    constructor(type) {
-        this.type = type;
-    }
-}
-
-class StubCustomEvent extends StubEvent {
-    constructor(type, init) {
-        super(type);
-        this.detail = init && init.detail;
-    }
-}
-
-// Every code the background emits on the RPC path today, read out of
-// src/background/index.js. The provider must not know this list — it passes
-// through whatever arrived — but the cases below are the real ones.
-const REJECTED = 4001; // user rejected the request
-const UNAUTHORIZED = 4100; // site not connected / wrong address
-const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
-
-// A stub window with the four things inpage.js touches: message listeners,
-// postMessage out to the content script, window.ethereum, and dispatchEvent
-// for the EIP-6963 announcement.
-function loadProvider() {
-    const messageListeners = [];
-    const posted = [];
-
-    const win = {
-        addEventListener(type, fn) {
-            if (type === "message") messageListeners.push(fn);
-        },
-        removeEventListener(type, fn) {
-            const i = messageListeners.indexOf(fn);
-            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
-        },
-        postMessage(data) {
-            posted.push(data);
-        },
-        dispatchEvent() {
-            return true;
-        },
-    };
-    win.window = win;
-
-    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
-
-    // Deliver the content script's answer to an outstanding request. The id is
-    // read back off the wire rather than assumed: inpage.js issues its own
-    // eth_chainId at load, so the first id a test sees is not 1.
-    function respond(response) {
-        const request = posted
-            .filter((m) => m.type === "AUTISTMASK_REQUEST")
-            .pop();
-        expect(request).toBeDefined();
-        const event = {
-            source: win,
-            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
-        };
-        for (const fn of messageListeners.slice()) fn(event);
-    }
-
-    return { provider: win.ethereum, posted, respond };
-}
-
-// Start a request, answer it with `response`, and hand back the rejection.
-// Fails the test if the call resolves instead.
-async function rejectionFrom(start, response) {
-    const { provider, respond } = loadProvider();
-    const settled = start(provider).then(
-        (result) => ({ resolved: result }),
-        (error) => ({ error }),
-    );
-    // The provider posts synchronously, so the request is already on the wire.
-    respond(response);
-    const outcome = await settled;
-    expect(outcome).not.toHaveProperty("resolved");
-    return outcome.error;
-}
-
-describe("an EIP-1193 code reaches the page", () => {
-    test("a user rejection arrives as code 4001", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-
-    test("it is a ProviderRpcError, and an Error", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect(err.name).toBe("ProviderRpcError");
-    });
-
-    test("4100 unauthorized arrives intact", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
-            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
-        );
-        expect(err.code).toBe(UNAUTHORIZED);
-        expect(err.message).toBe("Unauthorized");
-    });
-
-    test("4902 unrecognized chain arrives intact", async () => {
-        const message =
-            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "wallet_switchEthereumChain" }),
-            { error: { code: UNRECOGNIZED_CHAIN, message } },
-        );
-        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
-        expect(err.message).toBe(message);
-    });
-
-    // The provider is not allowed to know the list above: a code added to the
-    // background later must reach the page without this file being edited.
-    test("a code the provider has never heard of is passed through", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_accounts" }),
-            { error: { code: 4900, message: "Disconnected" } },
-        );
-        expect(err.code).toBe(4900);
-    });
-
-    test("data is carried when the boundary sent it", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_call" }),
-            {
-                error: {
-                    code: -32000,
-                    message: "execution reverted",
-                    data: "0x08c379a0",
-                },
-            },
-        );
-        expect(err.code).toBe(-32000);
-        expect(err.data).toBe("0x08c379a0");
-    });
-
-    test("no data property is invented when the boundary sent none", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect("data" in err).toBe(false);
-    });
-});
-
-describe("the message is untouched", () => {
-    test("a coded error keeps the message byte for byte", async () => {
-        const message =
-            "This site asked to sign as an address that is not " +
-            "the active one.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign" }),
-            { error: { code: UNAUTHORIZED, message } },
-        );
-        expect(err.message).toBe(message);
-    });
-
-    test("an error the background sent with no code keeps its message", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err.message).toBe("No accounts available");
-    });
-
-    // A ProviderRpcError whose code is undefined would claim a conformance it
-    // does not have, and `'code' in err` is exactly what a careful dApp asks.
-    test("an error with no code gets no code property at all", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect("code" in err).toBe(false);
-    });
-
-    test("an error with no message keeps the generic fallback", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { code: REJECTED } },
-        );
-        expect(err.message).toBe("Request failed");
-        expect(err.code).toBe(REJECTED);
-    });
-});
-
-// Every entry point the provider exposes, not just eth_requestAccounts. They
-// all funnel through the same response listener, and this is what says so.
-describe("every request path carries the code", () => {
-    const rejection = {
-        error: { code: REJECTED, message: "User rejected the request." },
-    };
-
-    test("request()", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("enable()", async () => {
-        const err = await rejectionFrom((p) => p.enable(), rejection);
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send(method, params)", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send("eth_requestAccounts", []),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send({ method, params })", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("sendAsync() hands the code to its callback", async () => {
-        const { provider, respond } = loadProvider();
-        const called = new Promise((resolve) => {
-            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
-                resolve(e),
-            );
-        });
-        respond(rejection);
-        const err = await called;
-        expect(err.name).toBe("ProviderRpcError");
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-});
-
-describe("the success path is unchanged", () => {
-    test("a result still resolves", async () => {
-        const { provider, respond } = loadProvider();
-        const settled = provider.request({ method: "eth_requestAccounts" });
-        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
-        await expect(settled).resolves.toEqual([
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        ]);
-        expect(provider.selectedAddress).toBe(
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        );
-    });
-});

tests/symbolSpoof.test.js

@@ -56,7 +56,7 @@ global.chrome = {
 };
 
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
-const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { filterTransactions } = require("../src/shared/transactions");
 const {
     fetchTokenBalances,
@@ -284,137 +284,11 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     // asserts the claim it stands for — `[ -~]` would admit an interior
     // space and let a whitespace-bearing entry through the guard.
     test("no bundled symbol is touched by the normalization", () => {
-        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
+        for (const [symbol, address] of KNOWN_SYMBOLS) {
             expect(symbol).toBe(symbol.trim());
             expect(symbol).toMatch(/^[!-~]+$/);
-            if (addresses === null) continue;
-            for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
-            }
-        }
-    });
-});
-
-// Issue #276: the guard that was missing.  The suite walked KNOWN_SYMBOLS,
-// which is built from TOKENS, so it could only ever assert that the table
-// agrees with itself.  Seven symbols appear twice in the bundled list at two
-// different real contracts, and the table kept whichever came first, so the
-// other seven contracts — tokens in our own shipped list, at their own
-// addresses — were judged spoofs and hidden from the balance list, the
-// history and the send selector.  That is the over-filtering direction: it
-// hides a holding the user cannot then spend.
-//
-// This walk is over TOKENS, the data the wallet actually ships, so it fails
-// whenever a bundled token would be filtered at its own address no matter
-// which side of the table the mistake is on.
-describe("the shipped token list", () => {
-    test("no bundled token is filtered at its own address", () => {
-        const filtered = TOKENS.filter((t) =>
-            isSpoofedSymbol(t.symbol, t.address),
-        ).map((t) => t.symbol + " @ " + t.address);
-        expect(filtered).toEqual([]);
-    });
-
-    // The third failure mode the issue asks about: a symbol whose table entry
-    // names an address that is in neither the table nor the list would be a
-    // contract we vouch for and do not ship.  There is none, and the table is
-    // built from the list, so this asserts the derivation has not acquired a
-    // hand-written entry.
-    test("every address the table vouches for is a bundled token", () => {
-        const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
-        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
-            if (addresses === null) continue;
-            expect(addresses.size).toBeGreaterThan(0);
-            for (const address of addresses) {
-                expect(address).toBe(address.toLowerCase());
-                expect(bundled.has(address)).toBe(true);
-                // And it is the token that actually reports that symbol.
-                const token = TOKENS.find(
-                    (t) => t.address.toLowerCase() === address,
-                );
-                expect(token.symbol.toUpperCase()).toBe(symbol);
-            }
-        }
-    });
-
-    // Both contracts behind a shared ticker must pass, from either side: a
-    // rule that admits only the one the table happens to visit first is the
-    // bug, not the fix.
-    test("both contracts behind a shared ticker are admitted", () => {
-        const bySymbol = new Map();
-        for (const t of TOKENS) {
-            const upper = t.symbol.toUpperCase();
-            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
-            bySymbol.get(upper).push(t);
-        }
-        const shared = [...bySymbol].filter(([, list]) => list.length > 1);
-        // The shared tickers are a fact about the shipped data; if a future
-        // list has none, this test would silently assert nothing.
-        expect(shared.length).toBeGreaterThan(0);
-        for (const [, list] of shared) {
-            for (const t of list) {
-                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
-            }
-        }
-    });
-
-    // The seven from issue #276, named so that the reconciliation is a fact
-    // in the suite: each is two real contracts from the same source fetch,
-    // and the table now holds both rather than the one that came first.
-    test("the seven shared tickers each name both bundled contracts", () => {
-        const expected = {
-            TON: [
-                "0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
-                "0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
-            ],
-            FRAX: [
-                "0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
-                "0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
-            ],
-            REUSD: [
-                "0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
-                "0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
-            ],
-            EURE: [
-                "0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
-                "0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
-            ],
-            MSUSD: [
-                "0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
-                "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
-            ],
-            MUSD: [
-                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
-                "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
-            ],
-            JPYC: [
-                "0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
-                "0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
-            ],
-        };
-        for (const [symbol, addresses] of Object.entries(expected)) {
-            expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
-                [...addresses].sort(),
-            );
-            for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
-            }
-        }
-    });
-
-    // The other direction, on the same symbols: widening the table to hold
-    // every bundled address for a ticker must not turn it into a pass for
-    // any other contract.
-    test("a shared ticker from a third contract is still a spoof", () => {
-        const bySymbol = new Map();
-        for (const t of TOKENS) {
-            const upper = t.symbol.toUpperCase();
-            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
-            bySymbol.get(upper).push(t);
-        }
-        for (const [symbol, list] of bySymbol) {
-            if (list.length < 2) continue;
-            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
+            if (address === null) continue;
+            expect(isSpoofedSymbol(symbol, address)).toBe(false);
         }
     });
 });

tests/transactions.test.js

@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
     });
 
     test("USDC and WETH map to their genuine lowercased contracts", () => {
-        expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
-        expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
+        expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
     });
 
     test("the spam fixture symbol is not in the known token list", () => {