docs: second rework of the release procedure after review

Apply the five wording findings of the second review verbatim: the owner's
rule as one lead-in with three acts, the yarn source without a pronoun, the
workflow definition with its file first, the two e2e jobs named with their
scripts, and the manifest version tied to step 2. The same three faults
were fixed elsewhere: pronouns with two candidates, phrases that arrive
after the words they belong to, and terms used before they were defined.

Model: fable-5-1

Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .

README.md

@@ -2053,15 +2053,21 @@ view would leave a wallet one click from deletion.
       fee estimate and the contract and never-sent recipient checks ask that
       network's RPC endpoint, and the Etherscan label check asks that network's
       explorer
-    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
+    - "Sign & Send" (correct password) when the gas limit or a fee is over its
-      total fee the RPC endpoint fills in at signing is over its bound in
+      bound → nothing is signed; "The gas limit or fee the RPC endpoint quoted
-      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
+      for this transaction is more than this wallet will sign for, so it was not
-      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
+      sent. Please go back and try again." in its own box, no screen change. For
-      is more than this wallet will sign for, so it was not sent. Please go back
+      an ETH amount that Send's "Max" filled in, the gas limit and fees are
-      and try again." in its own box, the same sentence for all three, no screen
+      those of this screen's own fee estimate (see Amount above). For any other
-      change
+      send, the RPC endpoint fills in the gas limit and fees at signing. Just
-    - "Sign & Send" (wrong password) → "Wrong password." on the password error
+      before signing, `assertWithinCeilings()` (`src/shared/approvalVerify.js`)
-      line, no screen change
+      refuses the send when any of these is over its bound:
+        - the gas limit
+        - each fee per gas the transaction sets
+        - the total fee: the gas limit times `maxFeePerGas`, or times `gasPrice`
+          when the transaction has no `maxFeePerGas`
+    - "Sign & Send" (wrong password) → "That password is incorrect. Please try
+      again." on the password error line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
       selected: the two are saved separately, so the popup can reopen onto this
       screen with another address selected. When the selected wallet does not

docs/RELEASE.md

@@ -1,87 +1,228 @@
 # Releasing AutistMask
 
-This is the procedure that turns a green `main` into a tagged, packaged release.
+A release is a tagged commit on the `main` branch and the two archives that
-It gathers into one place what is otherwise spread across the `Makefile` and
+`make package` writes from that commit. This file is the procedure, in order.
-three `README.md` sections, so the person cutting a release does not have to
-reconstruct the order from them.
 
-There is one version, declared in three files (`package.json`,
+Only the owner ([@sneak](https://sneak.berlin)):
-`manifest/chrome.json`, `manifest/firefox.json`), and `make package` builds and
+
-packages but publishes nothing. `make build` and `make package` can be run by
+- decides whether and when a release is tagged;
-anyone; tagging, signing, packing a CRX and any upload need credentials only the
+- creates, moves or deletes a tag;
-owner ([@sneak](https://sneak.berlin)) holds and are marked **owner-only**
+- decides where the archives are published.
-below. Releases are tagged from `main` (see the Workflow section of `TODO.md`),
+
-so the "release commit" throughout is the `main` commit the milestone PR merged.
+Anyone can run steps 1 to 4. No script in this repository uploads or publishes
+the archives. None signs them, and none packs a CRX (Chrome's packaged extension
+file).
+
+## Terms
+
+- The tracker is the repository's Gitea site (Gitea is the software that hosts
+  the repository): https://git.eeqj.de/sneak/AutistMask. The tracker's Actions
+  page, https://git.eeqj.de/sneak/AutistMask/actions, lists the workflow runs.
+- A workflow is a file under `.gitea/workflows/` that lists jobs. The tracker
+  runs every workflow on each push. Each job runs one script on the tracker's
+  runner (the machine that runs jobs).
+- The release commit is a commit on `main`. Releases are tagged from `main` only
+  (`TODO.md`, Workflow).
+- A clean checkout is a working tree (the checked-out files) at the release
+  commit where `git status --porcelain` prints nothing. The build stamps the
+  commit hash (the commit's id) into the extension and appends `-dirty` when the
+  tree has local changes.
+- A tag is a name that git attaches to one commit. Release tags read `vX.Y.Z`,
+  such as `v0.1.0`.
+- A digest is the sha256 hash of a file (a fixed-length fingerprint of its
+  bytes), written as 64 hexadecimal characters.
+
+## What you need
+
+- A clean checkout of the release commit.
+- `make`.
+- Docker (a tool that runs programs in containers), for `script/cibuild` in
+  step 1. `make package` needs no Docker.
+- Node and yarn. Both come from the system when present. Otherwise
+  `script/bootstrap` installs Node through a pinned (fixed-version) install of
+  nvm, a Node version manager. `script/bootstrap` installs yarn through corepack
+  (Node's package manager installer). When no corepack is found,
+  `script/bootstrap` installs yarn through `npm` (Node's package manager).
 
 ## Procedure
 
-1. **Confirm `main` is green in CI.** The `check` workflow
+### 1. Confirm the release commit is green
-   (`.gitea/workflows/check.yml`) runs `script/cibuild`, which runs
-   `script/check` and then builds the image uncached, so a green `check` run is
-   a green `make check`. Find the run for the exact release commit on the
-   tracker's Actions view. _Check:_ that commit's `check` run succeeded; running
-   `make check` on a clean checkout of the commit reproduces it and exits 0.
 
-2. **Confirm the version matches the intended tag.** `package.json`,
+The `check` workflow (`.gitea/workflows/check.yml`) runs `script/cibuild` on
-   `manifest/chrome.json` and `manifest/firefox.json` must all declare the same
+every push. `script/cibuild` runs:
-   `X.Y.Z`. `make build` fails when they disagree, but nothing checks that they
-   equal the tag you mean to create — that is this manual step. _Check:_ all
-   three files read the same `X.Y.Z`, and it is the version you intend to tag
-   `vX.Y.Z`.
 
-3. **Build and package from a clean checkout of that commit.** From a fresh
+- `script/bootstrap`, which installs the dependencies;
-   clone, or a working tree with no local modifications (`git status` clean),
+- `script/check`, which is what `make check` runs;
-   checked out at the release commit: run `make setup`, then `make package`.
+- the Docker image build (an image is Docker's packaged form of a program).
-   `make package` runs `make build` first, so the archives can only be made from
-   a `dist/` verified against that build's own receipt as a release (not debug)
-   build. It writes three files into `release/`:
-   `autistmask-chrome-<version>.zip`, `autistmask-firefox-<version>.xpi`, and
-   `SHA256SUMS`. _Check:_ those three files exist and `<version>` in the archive
-   names is the version confirmed in step 2. The Firefox `.xpi` is **unsigned**
-   (see step 6 and "Installing on Firefox" in `README.md`).
 
-4. **Verify `SHA256SUMS`.** The archives are deterministic — sorted entries,
+`script/check` runs:
-   fixed timestamps, fixed compression — so a second `make package` from another
-   clean checkout of the same commit produces byte-identical files. Verify the
-   recorded digests against the files with `sha256sum -c SHA256SUMS`, run from
-   `release/`. To confirm reproducibility, run `make package` again on a
-   separate clean checkout and compare the digests. _Check:_ `sha256sum -c`
-   reports `OK` for every file, and an independent build's digests match.
 
-5. **Tag the release commit.** _(owner-only)_ Create an annotated tag `vX.Y.Z`
+- `script/test`: the tests, in Docker;
-   on the release commit and push it: `git tag -a vX.Y.Z` (with a message), then
+- `script/lint`, which runs three checks in Docker:
-   `git push origin vX.Y.Z`. _Check:_ `git tag` lists `vX.Y.Z`, and
+    - ESLint, a code checker;
-   `git rev-parse vX.Y.Z^{commit}` resolves to the release commit.
+    - `prettier --check .`, the formatting check;
+    - `script/check-censored`, which fails when the name that `RULES.md` bars
+      appears outside its allowed places;
+- `script/fmt-check`: `prettier --check .` again, on the host.
 
-6. **Distribute per browser.** _(owner-only; pending the owner's choice on
+The `e2e` workflow (`.gitea/workflows/e2e.yml`) has two jobs. One runs
-   https://git.eeqj.de/sneak/AutistMask/issues/386)_ How 1.0.0 is distributed on
+`script/test-e2e`, the browser tests in Chrome. The other runs
-   each browser is not yet decided; it is the open question on that issue, and
+`script/test-e2e-firefox`, the browser tests in Firefox. A red `e2e` job does
-   the concrete steps cannot be written until the owner records a choice there.
+not fail the `check` run.
-   These steps need credentials only the owner holds. The options under
-   consideration are:
-    - **Firefox** — the packaged `.xpi` is unsigned, and release Firefox and ESR
-      refuse an unsigned add-on:
-        - (a) AMO self-distribution signing (unlisted): submit the `.xpi` to AMO
-          with the owner's credentials; AMO returns a signed `.xpi` installable
-          on every Firefox, with nothing listed publicly.
-        - (b) AMO listed: as (a), plus a public AMO listing and review.
-        - (c) Ship the unsigned `.xpi` and state that Firefox support means
-          Developer Edition, Nightly, or an Unbranded build with
-          `xpinstall.signatures.required` set to `false`.
-    - **Chrome** — the repo packs no CRX and publishes nothing; the extension id
-      is fixed by the `key` in `manifest/chrome.json`:
-        - (a) Chrome Web Store (unlisted): upload the `.zip` with the owner's
-          developer account; the store delivers installs and updates.
-        - (b) Self-hosted CRX signed with the private key the owner holds
-          (`chrome --pack-extension=dist/chrome --pack-extension-key=<path to the .pem>`),
-          installable only via enterprise policy on Windows and macOS, so
-          realistically Linux-only.
-        - (c) "Load unpacked" from `dist/chrome/` only, as today.
 
-    Once the owner decides, the chosen steps — including which credentials they
+Run `script/cibuild` on the clean checkout. `script/cibuild` runs the same steps
-    need and who holds them — are written into this section and `README.md`'s
+as the `check` run, and must exit 0.
-    installation sections are updated to match, which is part of the definition
+
-    of done of https://git.eeqj.de/sneak/AutistMask/issues/386. _Check:_ for a
+Check: on the Actions page, the `check` run for the release commit succeeded,
-    store or AMO route, the artifact installs from the store or AMO on a clean
+and both `e2e` jobs for that commit succeeded. `script/cibuild` exited 0 on the
-    browser profile; for the CRX or unpacked route, the documented load succeeds
+clean checkout.
-    and Chrome reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`.
+
+### 2. Confirm the version
+
+Three files declare the version:
+
+- `package.json`;
+- `manifest/chrome.json`;
+- `manifest/firefox.json`.
+
+`script/lib/version.js` fails the build when the three disagree.
+`tests/version.test.js` fails when the version is not three numbers separated by
+dots. Nothing compares the version with a tag. That comparison is this step.
+
+Check: all three files read the same `X.Y.Z`, and `vX.Y.Z` is the tag that the
+owner creates in step 5.
+
+### 3. Build and package
+
+On the clean checkout, run:
+
+```bash
+make setup
+make package
+```
+
+`make setup` installs two things:
+
+- the dependencies, from the lockfile `yarn.lock`, which pins each one's
+  version;
+- the git pre-commit hook, a script that git runs before each commit. Here the
+  hook runs `script/check`.
+
+`make package` runs `make build`, then `script/lib/package.js`.
+
+`make build`:
+
+- runs `build.js`. `build.js` writes `dist/chrome/`, `dist/firefox/` and a build
+  receipt. The receipt lists every file that `build.js` wrote, with each file's
+  digest. The receipt lives outside the repository and is deleted when the build
+  ends;
+- runs `script/verify-build --expect release` against the receipt. The check
+  fails when:
+    - `dist/` differs from the receipt;
+    - a bundle (one JavaScript file built from many source files) was compiled
+      with the build-time constant `DEBUG` on;
+    - any file carries the test recovery phrase, which a debug build gives every
+      new wallet;
+- runs `script/check-censored --require-dist` against the built files;
+- removes `dist/` when any of those steps fails.
+
+`script/lib/package.js`:
+
+- empties `release/`;
+- refuses a symbolic link (a file that points at another file) under `dist/`;
+- checks that the archive is self-contained: every file that the manifest or the
+  popup's HTML page names is inside the browser's directory (`dist/chrome/` or
+  `dist/firefox/`). The manifest is `manifest.json`, the file that describes the
+  extension to the browser. The popup is the window that the toolbar button
+  opens;
+- checks that the `version` in each `manifest.json` is the version from step 2;
+- writes one archive per browser;
+- reads each archive back;
+- compares every member (a file inside the archive) with `dist/` byte for byte;
+- writes `SHA256SUMS`, with one line per archive:
+    - the digest;
+    - two spaces;
+    - the file name.
+
+`make package` writes three files:
+
+```
+release/autistmask-chrome-<version>.zip
+release/autistmask-firefox-<version>.xpi
+release/SHA256SUMS
+```
+
+The `.xpi` is Firefox's add-on package file (an add-on is Firefox's word for an
+extension). The `.xpi` is not signed.
+
+`make package` prints a line that starts `Not shipped` and names `styles.css`.
+This is expected: each archive holds its own copy of the stylesheet.
+
+Check: `release/` holds those three files, and `<version>` in their names is the
+version from step 2.
+
+### 4. Verify the digests
+
+From `release/`, run `sha256sum -c SHA256SUMS`.
+
+The archives are deterministic for a given `dist/`: the same `dist/` always
+gives the same bytes. `script/lib/zip.js`:
+
+- sorts the members;
+- sets every member's timestamp (its recorded date) to 1980-01-01;
+- compresses each member the same way every time.
+
+`dist/` itself carries the build date. `build.js` compiles the build date, a UTC
+(universal time) day, into the extension. So two builds of the same commit on
+the same UTC day give byte-identical archives. Builds on different days differ.
+
+Check: `sha256sum -c` prints `OK` for both archives. On the same UTC day, a
+second `make package` from another clean checkout of the same commit gives the
+same `SHA256SUMS`.
+
+### 5. Tag the release commit
+
+Owner only. Only the owner decides whether and when a release is tagged. Only
+the owner creates, moves or deletes a tag. On the release commit, the owner
+runs:
+
+```bash
+git tag -a vX.Y.Z -m "AutistMask X.Y.Z"
+git push origin vX.Y.Z
+```
+
+`-a` makes an annotated tag: a tag that carries a message and records who made
+the tag and when. `v0.1.0` is one.
+
+Once the tag exists, `git describe --tags` on the release commit prints
+`vX.Y.Z`. `script/cibuild` and `script/docker` pass that value to the Docker
+image build as `VERSION`.
+
+Check: `git rev-parse vX.Y.Z^{commit}` prints the release commit's hash, and the
+tag is listed at https://git.eeqj.de/sneak/AutistMask/tags.
+
+### 6. Publish the archives
+
+Owner only. The owner decides where the archives are published. No script in
+this repository uploads or publishes them.
+
+Whoever receives an archive installs it as follows.
+
+Chrome loads the extension from a directory:
+
+- unzip the archive into a new, empty directory, for example
+  `unzip autistmask-chrome-0.1.0.zip -d autistmask-chrome`;
+- open `chrome://extensions/` and turn on "Developer mode";
+- click "Load unpacked" and pick that directory.
+
+Chrome then reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`. The id
+is the fixed string that identifies the extension to Chrome; the `key` in
+`manifest/chrome.json` sets the id.
+
+Release builds of Firefox refuse to install an unsigned add-on. Desktop Firefox
+115 or newer, in any edition, loads the `.xpi` as a temporary add-on from the
+`about:debugging` page. Firefox unloads a temporary add-on when Firefox exits.
+The section "Installing on Firefox" in `README.md` has the details.
+
+Check: each archive installs on a fresh browser profile (a new, empty set of
+browser data) by the route above.

eslint.config.js

@@ -153,8 +153,7 @@ module.exports = [
         },
     },
 
-    // The helpers the script/ entrypoints call: plain node programs too, run
+    // The files in script/lib/ run on plain node too, and are never bundled.
-    // from a shell script rather than from yarn, and never bundled.
     {
         files: ["script/lib/**/*.js"],
         languageOptions: {

package.json

@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "jest --forceExit --maxWorkers=3",
+        "test": "node script/lib/jest.js --maxWorkers=3",
-        "test:verbose": "jest --forceExit --maxWorkers=3 --verbose",
+        "test:verbose": "node script/lib/jest.js --maxWorkers=3 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",

script/bootstrap

@@ -118,6 +118,7 @@ ensure_yarn() {
     fi
 }
 
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \

script/lib/jest.js

@@ -0,0 +1,40 @@
+// Runs jest with the arguments it is given, and fails the run when jest had to
+// force-stop the worker process that ran a test file. Jest itself only prints a
+// warning when that happens, and its run still passes. The warning means a test
+// left a timer or another open handle running. The test scripts in package.json
+// run jest through this file.
+//
+// Jest runs inside this process and writes to the terminal directly, so its
+// output looks the same as a plain jest run. This file only checks each write
+// to stderr for the warning below.
+
+"use strict";
+
+// The start of the warning that jest prints on stderr after it force-stops a
+// worker process.
+const WORKER_WARNING = "A worker process has failed to exit gracefully";
+
+let forceStopped = false;
+
+const writeStderr = process.stderr.write.bind(process.stderr);
+process.stderr.write = (chunk, ...rest) => {
+    if (String(chunk).includes(WORKER_WARNING)) {
+        forceStopped = true;
+    }
+    return writeStderr(chunk, ...rest);
+};
+
+// Runs after jest has finished, as the process exits.
+process.on("exit", () => {
+    if (forceStopped) {
+        console.error(
+            "script/lib/jest.js: failing the run, because jest force-stopped " +
+                "a worker process. A test left a timer or another open " +
+                "handle running.",
+        );
+        process.exitCode = 1;
+    }
+});
+
+// Jest's own command-line program. It reads its arguments from process.argv.
+require("jest/bin/jest");

tests/addressKey.test.js

@@ -161,7 +161,7 @@ function click(element) {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 // ------------------------------------------------------------ harness
@@ -188,7 +188,11 @@ let sent;
 // handler to the buttons it drew, as the browser's fresh list would have.
 let plusButton;
 
+// showFlash() starts a timer that clears the message one or two seconds later.
+// Each test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     approvalDetails = null;
     sent = [];
     mockNode.broadcast = [];
@@ -239,6 +243,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+    jest.useRealTimers();
     jest.restoreAllMocks();
 });
 

tests/backgroundApproval.test.js

@@ -537,7 +537,18 @@ async function settleIncludingRejections() {
     await new Promise((resolve) => setImmediate(resolve));
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });
@@ -1883,18 +1894,6 @@ describe("a closed approval window leaves the request pending", () => {
         return bg.actionPopups[bg.actionPopups.length - 1];
     }
 
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
     test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();

tests/backgroundStateIsolation.test.js

@@ -103,7 +103,18 @@ function deferred() {
     return { promise, resolve };
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/chainSwitchGate.test.js

@@ -56,7 +56,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerChainSwitch.test.js

@@ -64,7 +64,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerSendTransaction.test.js

@@ -76,7 +76,18 @@ async function settle() {
     for (let i = 0; i < 60; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/connectedSitesWorkerRestart.test.js

@@ -57,7 +57,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });

tests/deleteWalletLostPassword.test.js

@@ -102,6 +102,17 @@ function makeDocument() {
 
 // ------------------------------------------------------------ harness
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
+beforeEach(() => {
+    jest.useFakeTimers();
+});
+
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 function wallet(name, secret, addresses) {
     return {
         type: "hd",

tests/sendAmountRule.test.js

@@ -131,10 +131,14 @@ async function review(amount, token) {
 async function confirm(amount, token) {
     const txInfo = await review("0.5", token);
     confirmTx.show({ ...txInfo, amount });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     state.wallets = [
         {
@@ -167,6 +171,10 @@ beforeEach(() => {
     state.currentView = null;
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe.each([
     ["1e-3", "ETH"],
     ["1e-3", "TOK"],

tests/sendMax.test.js

@@ -277,14 +277,18 @@ async function review() {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 function canSend() {
     return !el("btn-confirm-send").disabled;
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     log.errorf.mockClear();
     pageClosed = new AbortController();
@@ -297,6 +301,10 @@ beforeEach(() => {
     mockNode.broadcast = [];
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe("Max on an ETH send", () => {
     test("fills in the exact balance minus the fee reserve", async () => {
         await refreshWith(BALANCE_WEI);

tests/walletDefects.test.js

@@ -357,6 +357,11 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     beforeEach(() => {
+        // showFlash() starts a timer that clears the message two seconds
+        // later. Each test here runs on fake timers and drops them in
+        // afterEach, so that timer never outlives the test.
+        jest.useFakeTimers();
+
         const broken = brokenXprvWallet();
         // A balance, so that no Send button's zero-balance refusal can stand
         // in for the defect check.
@@ -398,6 +403,7 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     afterEach(() => {
+        jest.useRealTimers();
         state.wallets = [];
         state.activeAddress = null;
         state.selectedWallet = null;