fix: a swap split across steps the user pays for shows every amount it spends (closes #625)

The Amount line gave only the first swap step's amount. It now gives the
total the steps take of Token In: the amount of the step that sets the
input side plus each later take of it by a step the user pays. A V4
step, the first included, takes what its SETTLEs paid by the user state.
A take of another token, one after an amount that is not a quantity, or
one of unknown amount gets lines of its own. A step that may take what
the decoder did not read gets one line saying so and leaves no figure.
A PERMIT2_PERMIT names Token In; its amount stands only in the plain
shape of Uniswap's own routes.

Also closes #628.

Model: opus-5-5

README.md

@@ -461,15 +461,13 @@ address, the transaction assertions run against the raw signed transaction
 captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
-stored network unchanged and send no `chainChanged` until it is approved, the
-popup open all along is required to show the `[TESTNET]` banner once a switch to
-Sepolia is approved and to drop it once the switch back is, a network switch in
-Settings is required to send the page `chainChanged` with the new chain id, a
-prompt raised while another approval window has focus is required to open a
-window of its own, and the password is required to be absent from every message
-the approval window sends to the background — with the message that would carry
-it required to be present, so that check cannot pass by observing nothing. That
-last one is the standing floor under
+stored network unchanged and send no `chainChanged` until it is approved, a
+network switch in Settings is required to send the page `chainChanged` with the
+new chain id, a prompt raised while another approval window has focus is
+required to open a window of its own, and the password is required to be absent
+from every message the approval window sends to the background — with the
+message that would carry it required to be present, so that check cannot pass by
+observing nothing. That last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -502,12 +500,9 @@ papered over:
   forced by clicking Reveal and the settings gear in one page task, which a
   person cannot do; the case a person can hit, the first decrypt after the popup
   opens while libsodium is still loading, is not driven.
-- Approval windows open at 1280x720 whatever size the extension asks for. The
-  site-connection prompt and the transaction approval are checked for sideways
-  scrolling at 396x600 by sizing the page itself for that measurement only, and
-  the rest of each test runs at 1280x720. That leaves out the window's frame and
-  the page widening its window, so whether an approval screen fits its window is
-  checked in the Firefox suite only.
+- Approval windows open at 1280x720 whatever size the extension asks for, so
+  whether an approval screen fits its window is checked in the Firefox suite
+  only.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -605,10 +600,9 @@ suite), wallet creation through the UI, the Add Token screen, and the dApp round
 trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
 rejected and then approved, `eth_sendTransaction`, and a closed approval window
 rejecting with EIP-1193 4001 — driven through the real content script,
-background page and approval windows. The popup open all along is required to
-show the `[TESTNET]` banner once the switch to Sepolia is approved and to drop
-it once the switch back is. The `personal_sign` prompt is also required to fit
-its window without scrolling sideways, with the extension's pages at 170% zoom.
+background page and approval windows. The `personal_sign` prompt is also
+required to fit its window without scrolling sideways, with the extension's
+pages at 170% zoom.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -845,7 +839,7 @@ src/
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
     alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH and tracked token balances via RPC, others via Blockscout
+    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
@@ -1132,15 +1126,13 @@ scale is not an approximation but a different number — 1,000 units of a
 6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
 whose only job is to state what is being authorized. Both amount paths of that
 screen take this rule: the ERC-20 `transfer`/`approve` line
-(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
-`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
-a move into the router (`src/shared/uniswap.js`). The token permission warning
-on the signature screen takes the same rule for its amounts. An unbounded
-allowance or permit needs no scale to describe and is still shown as
-`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
-`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
-decimal places, so a token that reports 81 to 255 is shown as one whose scale
-nothing knows.
+(`src/popup/views/approval.js`) and the swap's `Amount` and `Min. received`
+lines (`src/shared/uniswap.js`). The token permission warning on the signature
+screen takes the same rule for its amounts. An unbounded allowance or permit
+needs no scale to describe and is still shown as `Unlimited`. A source's answer
+counts only if it is a whole number from 0 to 80: `decimals()` returns a
+`uint8`, but `formatUnits()` cannot format more than 80 decimal places, so a
+token that reports 81 to 255 is shown as one whose scale nothing knows.
 
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1173,8 +1165,8 @@ fetched, without that cross-address check, and shows the row's figure.
 **Decoded amount lines on the transaction approval screen:** the `Amount` line
 of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
 decoded swap (see TxApproval below; `Min. received` reads `Min. paid out` unless
-only the user is paid and no allowance goes to a spender other than the router,
-see Transaction Decoding), do not always read as a number. They can read:
+only the user is paid, see Transaction Decoding), do not always read as a
+number. They can read:
 
 - A formatted quantity, e.g. `17.1900 USDT`, when the token's scale is known:
   truncated to four decimals, with the floor and the zero cases described above.
@@ -1184,18 +1176,18 @@ see Transaction Decoding), do not always read as a number. They can read:
 - `Unlimited`: on the ERC-20 `Amount` line, an `approve` of the `uint256`
   maximum, an unbounded allowance. On the swap's `Amount` line, any amount at or
   above the `uint160` maximum, whichever step set the line: a `PERMIT2_PERMIT`
-  amount at that maximum, which is an unbounded permit, or a V2 or V3 exact-in
-  or exact-out or `WRAP_ETH` amount that large, which is not an allowance. The
+  amount at that maximum, which is an unbounded permit, or a V2 or V3 exact-in,
+  V2 exact-out or `WRAP_ETH` amount that large, which is not an allowance. The
   router's whole-balance value, `CONTRACT_BALANCE` (`2^255`), is one such
   amount.
-- `Up to <amount>`: the swap's `Amount` line, when the transaction has a V2 or
-  V3 exact-out step, whichever step set the line, including the `WRAP_ETH` of a
+- `Up to <amount>`: the swap's `Amount` line, when the transaction has a V2
+  exact-out step, whichever step set the line, including the `WRAP_ETH` of a
   swap paid in ETH and a `PERMIT2_PERMIT`. The swap spends at most that figure,
   not necessarily all of it; the wait, success and error screens show it with
   the same words. `Unlimited`, `All available (V4 open delta)` and
   `Whatever an earlier step sent to the pair (V2 already paid)` keep their
-  wording. When a V2 or V3 exact-out step sets `Min. received`, that line shows
-  its `amountOut`, the exact amount it buys.
+  wording. When a V2 exact-out step sets `Min. received`, that line shows its
+  `amountOut`, the exact amount it buys.
 - `All available (V4 open delta)`: the swap's `Amount` line, when the amount it
   shows is a V4 exact-in `amountIn` of zero. V4 reads that zero as "use the
   whole open delta", so the calldata states no quantity. Transaction Decoding
@@ -1243,50 +1235,20 @@ only when no earlier step set it. It finds each side by three rules:
    is their sum; in any other case the step gives no `Amount`. The decoder reads
    no amount from an exact-out action, and an open delta is not a stated amount.
    Its `Min. received` is found the same way, from the `amountOutMin` of the
-   actions that buy the output currency, except that the step gives none when a
-   swap action in it also spends the output currency, because the step then does
-   not pay out all that those actions buy. A step that buys at least 0.5 WETH
-   with USDT and swaps 0.3 WETH of it for USDC, with WETH as its output side,
-   gives no `Min. received`.
+   actions that buy the output currency. When the user pays the step any of the
+   input currency, its `Amount` is what the user pays instead (see Transaction
+   Decoding).
 3. If any swap action in the step could not be read, only `SETTLE`,
    `SETTLE_ALL`, `TAKE` and `TAKE_ALL` name its sides, and the step gives no
    `Amount` or `Min. received`. A side they did not name is unknown, and the
    step sets it as unknown with no figure.
 
-Under each of these rules, when the user pays the step any of the input
-currency, its `Amount` is instead what the user pays it of that currency when
-the decoder knows that amount, and otherwise there is none (see Transaction
-Decoding). So a step whose USDT-for-USDC swap action could not be read, with a
-`SETTLE` of 400 USDT paid by the user, reads `Amount 400.0000 USDT`.
-
 A V4 step with no swap action sets only the sides its `SETTLE`, `SETTLE_ALL`,
 `TAKE` or `TAKE_ALL` names.
 
-An `UNWRAP_WETH` step makes `Token Out` ETH only when no step set the output
-side, or when the output side is WETH, on mainnet or Sepolia, that the step that
-set it paid to the router and that the router still holds when the `UNWRAP_WETH`
-runs (Transaction Decoding below gives what the router holds). The router
-unwraps only the WETH it holds, so WETH that step paid to the user, or to anyone
-else, stays WETH: a swap that pays the router WETH, then a swap that pays the
-user WETH, then an unwrap, shows WETH with the second swap's minimum. The
-minimum reads in ETH only when that step paid all its WETH to the router and
-every step between it and the `UNWRAP_WETH` is one the decoder read of these: a
-`PERMIT2_PERMIT`, a `BALANCE_CHECK_ERC20`, or a `SWEEP`, `TRANSFER`,
-`PAY_PORTION` or `PAY_PORTION_FULL_PRECISION` of a token other than WETH, but
-not of ETH to a WETH contract, which pays the router WETH. None of these can
-take WETH out of the router or pay anyone WETH; the decoder treats every other
-step as one that may. Otherwise the swap shows ETH with no minimum, as it does
-after a V4 step that `TAKE`s some of its WETH to the user and the rest to the
-router, or that pays the router WETH beside a payout the decoder cannot read,
-and with a WETH interface fee paid by `PAY_PORTION` before the `UNWRAP_WETH`:
-the decoder does not count how much of that step's minimum reaches the
-`UNWRAP_WETH`, nor read the `UNWRAP_WETH`'s own minimum. When an `UNWRAP_WETH`
-of that WETH pays the router, or its recipient cannot be read, the router may
-hold the ETH, and a later step may pay it out as WETH, as a `WRAP_ETH` of it to
-the user does: after any later step but those listed, the swap shows WETH with
-no minimum. Once the swap shows no minimum, or shows WETH this way, no later
-step, a later `UNWRAP_WETH` included, brings back the minimum or ETH; only a
-later step that sets the output side sets it anew. Otherwise `Token Out` and
+An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side is WETH,
+on mainnet or Sepolia, or when no step set the output side; a WETH
+`Min. received` figure then reads in ETH. Otherwise `Token Out` and
 `Min. received` keep the output side's own token and figure, whether the swap
 was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
 unwraps the WETH it did not spend shows USDC. The token permission warning on
@@ -1379,30 +1341,23 @@ The core hierarchy is **Wallets → Addresses**:
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
-Which tokens an address shows is decided on every refresh by `refreshBalances()`
-in `src/shared/balances.js`. The balance of each token tracked on the active
-network is read with `balanceOf` through the RPC endpoint, for every address.
-Its holder count and `decimals` are those of Blockscout's entry for it in the
-same refresh, kept from before while Blockscout fails. A read that fails keeps
-that token's previous entry, as a failed ETH balance keeps its figure, or takes
-Blockscout's entry from the same refresh when there is none. Every other token
-comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
-tokens do appear without the user adding them, and they keep their previous
-figures while Blockscout fails. A tracked token is shown when its balance is
-nonzero, and any other ERC-20 when its balance is nonzero and it is in the
-bundled known-token list or has 1,000 or more holders. A token claiming a symbol
-from the bundled list from any other contract address is always dropped, tracked
-or not, and so is any token claiming a symbol that belongs to the native asset
-and therefore has no legitimate contract at all (`"ETH"`, and every network's
-`nativeCurrency`, such as `"SepoliaETH"`, on every network). That filter is
-unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
-the transaction history and the send-screen token selector, not this list. A
-token's holder count is unknown when the explorer reports none, or reports
-anything other than a whole number written in digits alone, such as `1,000` or
-`1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list does not
-take an unknown count as 1,000 or more, so such a token is shown only when it is
-on the bundled list or tracked. Every nonzero holding of a token shown is stored
-exactly, however small, but a holding below 0.000001 is left out of the balance
+Which tokens an address shows is decided by `fetchTokenBalances()` in
+`src/shared/balances.js`, from the Blockscout `token-balances` response, so
+tokens do appear without the user adding them. An ERC-20 is shown when its
+balance is nonzero and it is in the bundled known-token list, is tracked by the
+user, or has 1,000 or more holders; a token claiming a symbol from the bundled
+list from any other contract address is always dropped, and so is any token
+claiming a symbol that belongs to the native asset and therefore has no
+legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
+as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens with fewer than 1,000 holders" setting governs the transaction history
+and the send-screen token selector, not this list. A token's holder count is
+unknown when the explorer reports none, or reports anything other than a whole
+number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+or more, so such a token is shown only when it is on the bundled list or
+tracked. `fetchTokenBalances()` stores every nonzero holding of a token it
+admits, however small, but a holding below 0.000001 is left out of the balance
 lists, the send-screen token selector, the address total and the remove-address
 warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
@@ -1417,19 +1372,6 @@ carries a `schemaVersion` — `STATE_SCHEMA_VERSION` in
 `saveState()` and the background's `updateState()` both do, so whichever context
 wrote last, the record says which build's shape it is in.
 
-Each write reads the record, changes it and writes it back, holding a lock from
-the read to the write: the browser's own (`navigator.locks`), taken through
-`withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
-background share it, except a page in a Firefox private window, which Firefox
-gives locks of its own (see https://git.eeqj.de/sneak/AutistMask/issues/646).
-The popup's `saveState()`, the background's `updateState()` and the
-StateRecovery reset all take it, so among the pages and the background that
-share it, no write lands between another write's read and its write, where it
-would be lost. Chrome has it from version 69, older than any Chrome that runs a
-Manifest V3 extension, in pages and in the service worker; Firefox from version
-96, older than the 115 `manifest/firefox.json` declares. Where it is missing, a
-write fails rather than going ahead without it.
-
 Version 1 is the shape that shipped before versions existed, so a stored record
 with no `schemaVersion` is version 1 rather than a defect: it loads normally and
 is migrated in place by being stamped on the first write. An upgrade never shows
@@ -1578,29 +1520,20 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 
-A network switch leaves every screen on the page showing the previous network.
-The user makes it in Settings, or approves a site's request and the background
-saves it. Any other popup open meanwhile takes the switch from the stored
-record, even one saved while it was opening, and never switches the network
-itself. A switch the user picks in its Settings while it takes one is made after
-it, not overwritten by it. An approval window does not take the switch. After
-the switch, whichever way the page got it, "Back" behaves as in a reopened
-popup: every screen on the stack counts as not yet rendered, and the stack is
-cut at the first screen that cannot be rendered from saved state, such as Send
-or AddToken, or at AddressToken for any token but the native one, because that
-token was picked on the previous network and is no longer selected. The cut
-stack is saved with the popup's new network, so a popup closed straight after
-and reopened lands in the same place. The screen on top is drawn again for the
-new network: Settings in place, and any other screen as a reopened popup draws
-it, so Home takes the place of one that cannot be rendered from saved state or
-of AddressToken for a token no longer selected. "Back" then renders the screen
-it lands on for the new network, and anything typed there and not saved, which
-belonged to the previous network, is dropped. ConfirmTx, WaitTx, SuccessTx,
-ErrorTx and TransactionDetail are rendered instead for the network of the
-transaction they show: the network it was reviewed on for ConfirmTx, and the
-network it was sent on for the others. Without a wallet the stack is not cut and
-only Settings is drawn again, because the stack starts at Welcome, and Welcome
-and AddWallet show nothing from a network.
+A network switch in Settings leaves every screen beneath Settings showing the
+previous network, so after it "Back" behaves as in a reopened popup: every
+screen on the stack counts as not yet rendered, and the stack is cut at the
+first screen that cannot be rendered from saved state, such as Send or AddToken,
+or at AddressToken for any token but the native one, because that token was
+picked on the previous network. The cut stack is saved with the switch, so a
+popup closed straight after it and reopened onto Settings lands in the same
+place. "Back" then renders the screen it lands on for the new network, and
+anything typed there and not saved, which belonged to the previous network, is
+dropped. ConfirmTx, WaitTx, SuccessTx, ErrorTx and TransactionDetail are
+rendered instead for the network of the transaction they show: the network it
+was reviewed on for ConfirmTx, and the network it was sent on for the others.
+Without a wallet the stack is not cut, because it starts at Welcome, which shows
+nothing from a network.
 
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
@@ -2049,11 +1982,7 @@ view would leave a wallet one click from deletion.
     - Type: transaction classification — one of: Native ETH Transfer, ERC-20
       Token Transfer, Swap, Token Approval, Contract Call, Contract Creation. A
       transfer with a token contract is an ERC-20 Token Transfer whatever symbol
-      the token reports. A call named `execute` or `multicall` is a Swap, here
-      and on its history row, only when it was sent to one of the Universal
-      Router addresses Uniswap publishes for the network it was sent on (see
-      Transaction Decoding); sent to any other contract, its history row shows
-      the method name and this line reads Contract Call.
+      the token reports.
     - Status: "Success" or "Failed"
     - From: blockie + color dot + full address (tap to copy) + etherscan link;
       ENS name if available
@@ -2117,11 +2046,8 @@ view would leave a wallet one click from deletion.
       none, and the tokens tracked on that network, and sends `chainChanged`
       with the new chain id to every open tab. A token is tracked only on the
       network it was added on, because a contract address names a token on one
-      network only. Switching also clears every address's balances. A balance
-      refresh, by the popup or the background, stores what it fetched only if
-      the stored network is still the one it fetched on when it returns, so the
-      previous network's balances never reach the new one. Choosing the network
-      already active changes nothing and sends nothing
+      network only. Choosing the network already active changes nothing and
+      sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2450,12 +2376,10 @@ view would leave a wallet one click from deletion.
       transaction"
     - Decoded action (if calldata is recognized): action name, token details,
       amounts, what each swap step spends that the `Amount` line does not give,
-      what each `PERMIT2_TRANSFER_FROM` moves and where to, what each
-      `PERMIT2_PERMIT` whose amount is not the `Amount` figure, and each
-      `PERMIT2_PERMIT_BATCH`, lets its spender take, steps, deadline, and unless
-      a swap pays only the From address, a `Paid to` line for each other address
-      it pays, or saying that a token stays in the router or who it pays is
-      unknown (see Transaction Decoding)
+      what each `PERMIT2_TRANSFER_FROM` moves and where to, steps, deadline, and
+      unless a swap pays only the From address, a `Paid to` line for each other
+      address it pays, or saying that a token stays in the router or who it pays
+      is unknown (see Transaction Decoding)
     - From: color dot + full address + etherscan link
     - Contract: color dot + full address + etherscan link, token symbol label if
       known; for a contract creation, the same sentence as on WaitTx
@@ -2468,11 +2392,6 @@ view would leave a wallet one click from deletion.
     - Raw data: full calldata displayed inline (shown if present)
     - Password input and an error line
     - "Confirm" / "Reject" buttons
-- **Behavior**: Every etherscan link on the screen opens the explorer of the
-  network the transaction was populated on, whichever network is active. The
-  Value and Network fee lines each give the USD value of the exact amount at the
-  price on that network, as on ConfirmTx: none for a testnet transaction or one
-  on a chain id that names no network.
 - **Transitions**:
     - "Confirm" (correct password) → decrypts and signs the transaction it was
       shown, exactly as shown, hands the signed transaction to the background to
@@ -2669,8 +2588,7 @@ AutistMask is not a fully self-contained offline tool. It necessarily
 communicates with three external services to function as a wallet:
 
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
-  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
-  them the balance of every tracked token at every address (`balanceOf`),
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
   receipts. The default endpoint is a public RPC (configurable by the user to
@@ -3084,35 +3002,29 @@ Currently supported:
   Router addresses Uniswap publishes for the network: on TxApproval the network
   the transaction is for, on TransactionDetail the network it was sent on. The
   same calldata sent to any other address is shown as raw data. Decodes Permit2,
-  V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V3 swap step's path is read
-  as the router reads it: a `V3_SWAP_EXACT_IN` path runs from the token it
-  spends to the token it buys, and a `V3_SWAP_EXACT_OUT` path from the token it
-  buys to the token it spends, so that step's input token is its path's last
-  token and its output token the first. The router reads a path as one token
-  address followed by whole hops of a 3-byte fee and a token address, and
-  ignores any bytes after the last hop, so the decoder does not read a path with
-  such bytes. A V4 swap action is read only in the parameter shape deployed on
-  mainnet and Sepolia, not in the newer one on `v4-periphery` `main`, which adds
-  a `minHopPriceX36` field. An action in any other shape is not read, and its
-  step is listed as `V4 Swap (could not be decoded)`. Each step is named and
-  read as the command that the release of the router at that address runs for
-  its command type, as that release's `contracts/libraries/Commands.sol` names
-  it. The decoder reads the type from the command byte with the mask that router
-  uses: `0x1f` for `UniversalRouterV1`, `0x3f` for
-  `UniversalRouterV1_2_V2Support` and `UniversalRouterV2`, and `0x7f` for
-  `UniversalRouterV2_1_1` and `UniversalRouterV2_1_2`. The allow-revert flag
-  (`0x80`) therefore does not change the command a step is read as. Releases run
-  different commands for some types: on `UniversalRouterV1` and
-  `UniversalRouterV1_2_V2Support`, `0x10` to `0x13` are NFT commands, where the
-  later routers run `V4_SWAP`, `V3_POSITION_MANAGER_PERMIT`,
-  `V3_POSITION_MANAGER_CALL` and `V4_INITIALIZE_POOL`. The decoder does not read
-  those routers' NFT commands, and lists each by its name there, for example
-  `Seaport` for `SEAPORT` (`0x10` on `UniversalRouterV1`). A type a release
-  names no command for is listed by its number, for example `Command 0x0e` on
-  `UniversalRouterV1`, which has no `BALANCE_CHECK_ERC20` and reverts on it. The
-  router reverts the whole transaction when a step fails, unless the step's
-  command byte has that flag set and its command is one the router lets fail, as
-  each release's `contracts/base/Dispatcher.sol` shows: on `UniversalRouterV2`,
+  V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap action is read only
+  in the parameter shape deployed on mainnet and Sepolia, not in the newer one
+  on `v4-periphery` `main`, which adds a `minHopPriceX36` field. An action in
+  any other shape is not read, and its step is listed as
+  `V4 Swap (could not be decoded)`. Each step is named and read as the command
+  that the release of the router at that address runs for its command type, as
+  that release's `contracts/libraries/Commands.sol` names it. The decoder reads
+  the type from the command byte with the mask that router uses: `0x1f` for
+  `UniversalRouterV1`, `0x3f` for `UniversalRouterV1_2_V2Support` and
+  `UniversalRouterV2`, and `0x7f` for `UniversalRouterV2_1_1` and
+  `UniversalRouterV2_1_2`. The allow-revert flag (`0x80`) therefore does not
+  change the command a step is read as. Releases run different commands for some
+  types: on `UniversalRouterV1` and `UniversalRouterV1_2_V2Support`, `0x10` to
+  `0x13` are NFT commands, where the later routers run `V4_SWAP`,
+  `V3_POSITION_MANAGER_PERMIT`, `V3_POSITION_MANAGER_CALL` and
+  `V4_INITIALIZE_POOL`. The decoder does not read those routers' NFT commands,
+  and lists each by its name there, for example `Seaport` for `SEAPORT` (`0x10`
+  on `UniversalRouterV1`). A type a release names no command for is listed by
+  its number, for example `Command 0x0e` on `UniversalRouterV1`, which has no
+  `BALANCE_CHECK_ERC20` and reverts on it. The router reverts the whole
+  transaction when a step fails, unless the step's command byte has that flag
+  set and its command is one the router lets fail, as each release's
+  `contracts/base/Dispatcher.sol` shows: on `UniversalRouterV2`,
   `UniversalRouterV2_1_1` and `UniversalRouterV2_1_2`, `PERMIT2_PERMIT`,
   `PERMIT2_PERMIT_BATCH`, `BALANCE_CHECK_ERC20`, `V3_POSITION_MANAGER_PERMIT`,
   `V3_POSITION_MANAGER_CALL`, `V4_INITIALIZE_POOL`, `V4_POSITION_MANAGER_CALL`
@@ -3175,43 +3087,40 @@ Currently supported:
   as a swap paid in ETH does, but only when that amount is not
   `CONTRACT_BALANCE` and the router held no WETH from an earlier step when the
   `WRAP_ETH` ran: after two `WRAP_ETH`s of 0.5 ETH into the router, a swap of 1
-  WETH from it reads as leaving the WETH there. A V2 or V3 exact-out step paid
-  from the router spends an amount the calldata does not state, at most its
-  `amountInMax`, so the decoder counts it as spending nothing the router holds.
-  A `SETTLE` of `OPEN_DELTA` (zero), and a `SETTLE_ALL`, pay only what the step
-  still owes of their token when they run. The decoder takes that to be the
-  amounts the step's swap actions state they spend of that token only when every
-  action in the step could be read, every swap action names the token it spends
-  and the token it buys (a swap action with an empty path swaps nothing), the
-  `SETTLE` or `SETTLE_ALL` is the step's only `SETTLE` or `SETTLE_ALL` of that
-  token and comes after every swap action, no swap action buys that token, no
-  `TAKE`, `TAKE_ALL` or `TAKE_PORTION` in the step takes it (a `TAKE` of a
-  stated amount adds to what the step owes), and the swap actions that spend it
-  state a quantity together; otherwise it does not know the amount, and such a
-  `SETTLE` from the router counts as spending nothing. So the rest of a V4
-  `SETTLE` of more than its swap spends, taken to the router, the WETH of a
-  `WRAP_ETH`, and a token a swap pays the router on the way to the output, each
-  stays in the router when later steps do not spend all of it, where anyone can
-  take it in a later transaction. The router sends ETH as written, so a
-  `TRANSFER` of `CONTRACT_BALANCE` of ETH always reverts and pays out nothing. A
-  step paying a token to the V2 pair that the very next step spends, as a V2
-  exact-in of that token whose `amountIn` is `ALREADY_PAID` (zero) or
-  `CONTRACT_BALANCE`, is a hop, not a payout: Uniswap's mixed routes pay the
-  next V2 pair directly, and the router enforces that swap's own minimum. The
-  decoder checks that the address paid is that pair, deriving it from the V2
-  factory and pair init code hash the network's routers were deployed with and
-  the first two tokens of that step's path; a payment to any other address is
-  named. (Sepolia's `UniversalRouterV1_2_V2Support` was deployed with
-  placeholders for both values, so no V2 swap step can succeed on that router.)
-  Every other payment counts, in whichever step and of whatever token, a share
-  of the output included: an interface fee paid to another address by
-  `PAY_PORTION`, `TRANSFER` or `TAKE_PORTION` is named, and the minimum reads
-  `Min. paid out`, because the swap's minimum includes the fee. The minimum
-  reads `Min. received` only when some step pays the transaction's sender (the
-  From address on TxApproval, the sender the explorer reports on
-  TransactionDetail), no `Paid to` line is shown, and no permit or batch grants
-  an allowance to a spender other than the router (see below). `Paid to` lines
-  after `Token Out` name each other address paid; one reads
+  WETH from it reads as leaving the WETH there. A `SETTLE` of `OPEN_DELTA`
+  (zero), and a `SETTLE_ALL`, pay only what the step still owes of their token
+  when they run. The decoder takes that to be the amounts the step's swap
+  actions state they spend of that token only when every action in the step
+  could be read, every swap action names the token it spends and the token it
+  buys (a swap action with an empty path swaps nothing), the `SETTLE` or
+  `SETTLE_ALL` is the step's only `SETTLE` or `SETTLE_ALL` of that token and
+  comes after every swap action, no swap action buys that token, no `TAKE`,
+  `TAKE_ALL` or `TAKE_PORTION` in the step takes it (a `TAKE` of a stated amount
+  adds to what the step owes), and the swap actions that spend it state a
+  quantity together; otherwise it does not know the amount, and such a `SETTLE`
+  from the router counts as spending nothing. So the rest of a V4 `SETTLE` of
+  more than its swap spends, taken to the router, the WETH of a `WRAP_ETH`, and
+  a token a swap pays the router on the way to the output, each stays in the
+  router when later steps do not spend all of it, where anyone can take it in a
+  later transaction. The router sends ETH as written, so a `TRANSFER` of
+  `CONTRACT_BALANCE` of ETH always reverts and pays out nothing. A step paying a
+  token to the V2 pair that the very next step spends, as a V2 exact-in of that
+  token whose `amountIn` is `ALREADY_PAID` (zero) or `CONTRACT_BALANCE`, is a
+  hop, not a payout: Uniswap's mixed routes pay the next V2 pair directly, and
+  the router enforces that swap's own minimum. The decoder checks that the
+  address paid is that pair, deriving it from the V2 factory and pair init code
+  hash the network's routers were deployed with and the first two tokens of that
+  step's path; a payment to any other address is named. (Sepolia's
+  `UniversalRouterV1_2_V2Support` was deployed with placeholders for both
+  values, so no V2 swap step can succeed on that router.) Every other payment
+  counts, in whichever step and of whatever token, a share of the output
+  included: an interface fee paid to another address by `PAY_PORTION`,
+  `TRANSFER` or `TAKE_PORTION` is named, and the minimum reads `Min. paid out`,
+  because the swap's minimum includes the fee. The minimum reads `Min. received`
+  only when some step pays the transaction's sender (the From address on
+  TxApproval, the sender the explorer reports on TransactionDetail) and no
+  `Paid to` line is shown. `Paid to` lines after `Token Out` name each other
+  address paid; one reads
   `The bridge, which pays the deposit's recipient on another network` for a
   bridge deposit; one reads, for example,
   `The router, 2000.0000 USDT from the sender (later steps may not spend all of it)`
@@ -3225,77 +3134,52 @@ Currently supported:
   `Unknown (not named in the calldata)`. Wherever there is a `Paid to` line, the
   minimum reads `Min. paid out`. The `Amount` line gives the total the steps
   take of `Token In`, from the step that sets the input side on: the first V2 or
-  V3 exact-in or exact-out, `WRAP_ETH` or V4 swap step that names an input token
-  or amount. A V4 step with a swap action sets the input side when no earlier
-  step set it, even when it names neither (see Display Consistency). That step
-  counts its own amount, whoever pays it: a V2 or V3 exact-out step its
+  V3 exact-in, V2 exact-out, `WRAP_ETH` or V4 swap step that names an input
+  token or amount. A V4 step with a swap action sets the input side when no
+  earlier step set it, even when it names neither (see Display Consistency).
+  That step counts its own amount, whoever pays it: a V2 exact-out step its
   `amountInMax`, and a V4 step what it takes of its input token from the user's
   wallet, as below, or, when the user pays it none of that token, the `amountIn`
-  of the swap action that spends it. Each later V2 or V3 exact-in or exact-out
-  step whose `payerIsUser` is true takes its amount, found in the same way, from
-  the user's wallet. Every V4 step, with a swap action or without, takes from
-  the user's wallet what its `SETTLE`s paid by the user (`payerIsUser` true) and
-  its `SETTLE_ALL`s pay, for each token on its own; what the step that sets the
-  input side takes of any other token counts as a later step's take. A `SETTLE`
-  of any amount but `OPEN_DELTA` pays that amount, and a `SETTLE` of
-  `OPEN_DELTA` or a `SETTLE_ALL` pays what the step owes, as above. So a V4 step
-  that swaps 400 USDT, with a `SETTLE` of 5,000 USDT paid by the user and the
-  rest taken to another address, reads `5000.0000 USDT`. A later step paid from
-  the router spends what the router holds and takes nothing, and so does a V2
-  exact-in whose `amountIn` is `ALREADY_PAID`. A later take of `Token In` is
-  added to the total while both are quantities: a V3 exact-in of 600 USDT and a
-  V2 exact-in of 400 USDT, both paid by the user, read `1000.0000 USDT`. When
-  the decoder does not know a take's amount, the total is not known and there is
-  no `Amount` line. A `PERMIT2_PERMIT` names `Token In` only when its amount,
-  `Unlimited` included, stands as the `Amount` figure in place of the total,
-  which it does only in the plain shape of Uniswap's own routes: it comes before
-  the step that sets the input side, it is the only `PERMIT2_PERMIT` in the
-  transaction and there is no `PERMIT2_PERMIT_BATCH`, its spender is the router,
-  the router may not let it fail, no step before it takes its token, a
-  `PERMIT2_TRANSFER_FROM` of it included, or a token the decoder does not know,
-  and the decoder reads every step after it in full. Permit2 then lets the
-  router take no more of the token than that amount, so the permit covers every
-  take of it. A step before the permit takes under whatever allowance the router
-  already had, so it may take more than the permit's amount, which would then
-  read lower than what leaves the user's wallet: a `PERMIT2_TRANSFER_FROM` of
-  2,000 USDT into the router, then a permit of 600 USDT to the router and a V3
-  exact-in of 2,000 USDT paid from the router, read `Amount 2000.0000 USDT`. A
-  later permit or batch may raise what Permit2 lets the router take, and so may
-  a step the decoder does not read in full: a command the decoder does not read
-  (listed at the end of this section), a step whose input it cannot read, in
-  whole or in part, and a step it fails on. Every other `PERMIT2_PERMIT`, before
-  the step that sets the input side or after it, leaves `Token In` and the
-  `Amount` line as they read with no permit, unless it lets a spender other than
-  the router take `Token In` (see below): a permit of 5,000 DAI to another
-  address and then a V3 exact-in of 600 USDT read `Swap USDT → USDC` with
-  `Amount 600.0000 USDT`, and so do that exact-in and then a permit of 5,000 DAI
-  to the router. When a permit's amount stands and the step that sets the input
-  side spends a token other than the permit's, or one the decoder does not know,
-  that step's amount gets lines of its own, unless it states no amount and the
-  user pays it none of its input token. Each take the total does not count gives
-  three lines after the `Amount` line (after `Token In` when there is none): one
-  of a token other than `Token In`; one of `Token In` after an amount that is
-  not a quantity (a V4 open delta, `ALREADY_PAID`, which keep their wording on
-  the `Amount` line, or no stated amount, as of a V4 exact-out step); and one
-  whose amount the decoder does not know. When there is no `Amount` line, each
-  take the total counts gets them too, so that every amount the decoder reads is
-  shown: the amount the step that sets the input side states, when it is a
-  quantity and the user pays that step (a V2 or V3 step whose `payerIsUser` is
-  true, a V4 step the user pays some of its input token, or a `WRAP_ETH`, whose
-  ETH comes from the transaction's value), and each later take of `Token In`
-  added to it. A step that sets the input side and is paid from the router takes
-  nothing from the user's wallet and gets none. A `PERMIT2_PERMIT` the decoder
-  cannot read, then V3 exact-ins of 600 USDT and 400 DAI paid by the user, give
-  lines for both amounts. When the step that sets the input side states no
-  amount, the user pays it some of its input token, and there is no `Amount`
-  line, that step gets them too whenever another take's lines give a figure, or
-  a `PERMIT2_TRANSFER_FROM` of its token gives one, on the lines below or, into
-  the router, on its `Paid to` line, so that figure cannot read as all that
-  leaves. When it states no amount and the user pays it none of its input token,
-  as when the router pays it, that step takes none of that token from the user's
-  wallet and never gets them, with a permit or without. They come in step order,
-  except that the step that sets the input side comes first when it has them,
-  followed, when there is no `Amount` line, by the other takes the total counts:
+  of the swap action that spends it. Each later V2 or V3 exact-in or V2
+  exact-out step whose `payerIsUser` is true takes its amount, found in the same
+  way, from the user's wallet. Every V4 step, with a swap action or without,
+  takes from the user's wallet what its `SETTLE`s paid by the user
+  (`payerIsUser` true) and its `SETTLE_ALL`s pay, for each token on its own;
+  what the step that sets the input side takes of any other token counts as a
+  later step's take. A `SETTLE` of any amount but `OPEN_DELTA` pays that amount,
+  and a `SETTLE` of `OPEN_DELTA` or a `SETTLE_ALL` pays what the step owes, as
+  above. So a V4 step that swaps 400 USDT, with a `SETTLE` of 5,000 USDT paid by
+  the user and the rest taken to another address, reads `5000.0000 USDT`. A
+  later step paid from the router spends what the router holds and takes
+  nothing, and so does a V2 exact-in whose `amountIn` is `ALREADY_PAID`. A later
+  take of `Token In` is added to the total while both are quantities: a V3
+  exact-in of 600 USDT and a V2 exact-in of 400 USDT, both paid by the user,
+  read `1000.0000 USDT`. When the decoder does not know a take's amount, the
+  total is not known and there is no `Amount` line. `Token In` is the token of
+  the last `PERMIT2_PERMIT` the decoder reads, when there is one. Its amount,
+  `Unlimited` included, stands as the `Amount` figure in place of the total only
+  in the plain shape of Uniswap's own routes: it is the only `PERMIT2_PERMIT`,
+  its spender is the router, the router may not let it fail, no step before it
+  takes its token or a token the decoder does not know, and the decoder reads
+  every step after it in full. Permit2 then lets the router take no more of the
+  token than that amount, so the permit covers every take of it. A step the
+  decoder does not read in full may raise what Permit2 lets the router take, as
+  a `PERMIT2_PERMIT_BATCH` can: a command the decoder does not read (listed at
+  the end of this section), a step whose input it cannot read, in whole or in
+  part, and a step it fails on. In any other case the line gives the total, as
+  with no permit. When the step that sets the input side spends a token other
+  than the permit's, or one the decoder does not know, its amount gets lines of
+  its own and the total has no figure to start from: unless the permit's amount
+  stands there is no `Amount` line, and each take of the permit's token gets
+  lines of its own. Each take the total does not count gives three lines after
+  the `Amount` line (after `Token In` when there is none): one of a token other
+  than `Token In`; one of `Token In` after an amount that is not a quantity (a
+  V4 open delta, `ALREADY_PAID`, which keep their wording on the `Amount` line,
+  or no stated amount, as of a V4 exact-out step); and one whose amount the
+  decoder does not know. When the step that sets the input side states no amount
+  and there is no `Amount` line, that step gets them too whenever another take's
+  lines give a figure, so that figure cannot read as all that leaves. They come
+  in step order, the step that sets the input side first when it has them:
   `Moved from the sender`, its amount, worded as the `Amount` line words one, or
   `Unknown (could not be decoded)` when the decoder does not know it;
   `Token moved`, giving the token's address as the `Token In` line does; and
@@ -3303,56 +3187,32 @@ Currently supported:
   does not know gives the `Moved from the sender` line alone. A step may also
   take from the user's wallet what the decoder did not read: a V4 step whose
   input or one of whose `SETTLE`s or `SETTLE_ALL`s it cannot read, which the
-  router still runs; a V2 or V3 exact-in or exact-out step or a
-  `PERMIT2_TRANSFER_FROM` whose input it cannot read, such as a V3 step whose
-  path is shorter than one token address or has bytes after its last hop; every
-  `PERMIT2_TRANSFER_FROM_BATCH`; every `EXECUTE_SUB_PLAN`, wherever it stands;
-  and every step it fails on. Each such step gives one `Moved from the sender`
-  line among those, reading `Unknown (could not be decoded)`. That line, or any
-  line for a token the decoder does not know, leaves no `Amount` line, whose
-  figure might be too low, and such a step before a `PERMIT2_PERMIT` keeps the
-  permit's amount from standing. Then each `PERMIT2_TRANSFER_FROM` but one into
-  the router, in step order, gives three lines: `Moved from the sender`, the
-  amount it moves, for example `1000000.0000 USDT`; `Token moved`, giving the
-  token's address as the `Token In` line does; and `Moved to`, which reads
+  router still runs; a V2 or V3 exact-in or V2 exact-out step or a
+  `PERMIT2_TRANSFER_FROM` whose input it cannot read; every
+  `PERMIT2_TRANSFER_FROM_BATCH`; every `V3_SWAP_EXACT_OUT`, which the decoder
+  does not read, wherever it stands; every `EXECUTE_SUB_PLAN`, wherever it
+  stands; and every step it fails on. Each such step gives one
+  `Moved from the sender` line among those, reading
+  `Unknown (could not be decoded)`. That line, or any line for a token the
+  decoder does not know, leaves no `Amount` line, whose figure might be too low,
+  and such a step before a `PERMIT2_PERMIT` keeps the permit's amount from
+  standing. Then each `PERMIT2_TRANSFER_FROM` but one into the router, in step
+  order, gives three lines: `Moved from the sender`, the amount it moves, for
+  example `1000000.0000 USDT`; `Token moved`, giving the token's address as the
+  `Token In` line does; and `Moved to`, which reads
   `The V2 pair the next swap spends` for a hop and `The sender` for `address(1)`
   on every router but `UniversalRouterV1`, and otherwise gives the address. A
   move into the router needs none of them, because its `Paid to` line and
   `Token moved into the router` line already give the amount, the token and
-  where it goes, and so its amount is shown once. Every `PERMIT2_PERMIT` whose
-  amount does not stand as the `Amount` figure, before the step that sets the
-  input side or after it, gives three lines, in step order, after those for each
-  `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
-  `5000.0000 DAI`, or `Unlimited` for Permit2's maximum; `Allowance token`,
-  giving the token's address as the `Token In` line does; and
-  `Allowance spender`, the address it lets take the token. Only a permit whose
-  amount stands gives none: the `Amount` line gives its amount, `Token In` its
-  token, and its spender is the router. Each allowance a `PERMIT2_PERMIT_BATCH`
-  grants, one for each token it names, all for its one spender, gives the same
-  three lines, in step order with those of each `PERMIT2_PERMIT`. A
-  `PERMIT2_PERMIT` or `PERMIT2_PERMIT_BATCH` whose input the decoder cannot
-  read, such as one whose token or spender word has a nonzero top byte, may let
-  any spender take any amount of any token: it gives one `Permit2 allowance`
-  line alone, reading `Unknown (could not be decoded)`. These lines change no
-  `Paid to` line: a permit or batch pays nobody. But code that a step runs, such
-  as a V4 pool's hook or a token's own code, can call a spender other than the
-  router, which can then take up to its allowance from the user's wallet before
-  the transaction ends. So an allowance to any spender but the router, or a
-  permit or batch the decoder cannot read, makes the minimum read
-  `Min. paid out`, and when its token is `Token In`, or the decoder does not
-  know its token or `Token In`, it leaves no `Amount` line, whose figure might
-  be too low: a permit of 5,000 USDT to another address and then a V3 exact-in
-  of 600 USDT read with no `Amount` line, and the 600 USDT gets lines of its
-  own. A step goes unread when its recipient does not decode as an address, when
-  it is a V3 swap step whose path is shorter than one token address or has bytes
-  after its last hop, or when it is a command the decoder does not read: every
-  command other than `PERMIT2_PERMIT`, `PERMIT2_PERMIT_BATCH`,
-  `PERMIT2_TRANSFER_FROM`, `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`,
-  `V3_SWAP_EXACT_IN`, `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`,
-  `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`,
-  `WRAP_ETH`, `UNWRAP_WETH` and `BALANCE_CHECK_ERC20`
-  (`PERMIT2_TRANSFER_FROM_BATCH`, `EXECUTE_SUB_PLAN` and the NFT commands among
-  them), or a type its release names no command for.
+  where it goes, and so its amount is shown once. These lines change neither the
+  `Paid to` lines nor the minimum's label. A step goes unread when its recipient
+  does not decode as an address, or when it is a command the decoder does not
+  read: every command other than `PERMIT2_PERMIT`, `PERMIT2_TRANSFER_FROM`,
+  `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`, `V3_SWAP_EXACT_IN`, `V4_SWAP`,
+  `SWEEP`, `TRANSFER`, `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`,
+  `ACROSS_V4_DEPOSIT_V3`, `WRAP_ETH`, `UNWRAP_WETH` and `BALANCE_CHECK_ERC20`
+  (`V3_SWAP_EXACT_OUT`, `PERMIT2_TRANSFER_FROM_BATCH`, `EXECUTE_SUB_PLAN` and
+  the NFT commands among them), or a type its release names no command for.
 
 ### Non-Goals Forever
 

package.json

@@ -13,11 +13,6 @@
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
-    "jest": {
-        "setupFiles": [
-            "<rootDir>/tests/support/navigatorLocks.js"
-        ]
-    },
     "devDependencies": {
         "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "4.3.1",

src/background/index.js

@@ -1379,13 +1379,6 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // balances that came back — by address, onto whatever storage holds NOW.
 // Applying by address rather than writing the array back is what keeps a
 // wallet or address added, renamed or deleted during the round trip.
-//
-// Nothing is applied when the network stored NOW is not the one the refresh
-// ran on. A network switch during the round trip cleared every address's
-// balances (applyChainSwitchFields()), and the previous network's must not come
-// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
-// lastBalanceRefresh is left as the switch set it, so the next tick refreshes
-// the new network.
 async function backgroundRefresh() {
     const s = await getState();
     const now = Date.now();
@@ -1409,7 +1402,6 @@ async function backgroundRefresh() {
     }
 
     await updateState((fresh) => {
-        if (fresh.networkId !== s.networkId) return;
         for (const wallet of fresh.wallets) {
             for (const addr of wallet.addresses || []) {
                 const got = refreshed.get(String(addr.address).toLowerCase());

src/background/state.js

@@ -16,20 +16,17 @@
 //                     across any number of awaits and no concurrent work can
 //                     move it.
 //   updateState(fn)   read fresh, apply fn to that fresh record, write it
-//                     back — all holding the lock every write of the stored
-//                     record takes, so no other write lands in between, by
-//                     the background or by any page except a page in a
-//                     Firefox private window (README, "Stored state and its
-//                     version"). The read is one storage round trip ahead of
-//                     the write rather than a page lifetime ahead of it
-//                     (which is what made the popup's saveState() need a
+//                     back — all inside a queue, so two background writes
+//                     never interleave, and the read is one storage round trip
+//                     ahead of the write rather than a page lifetime ahead of
+//                     it (which is what made the popup's saveState() need a
 //                     per-field merge against a baseline at all).
 //
 // A handler that must both read and write therefore does its network work
 // against a snapshot it owns, and applies the RESULT inside updateState().
 // It never publishes an object other in-flight work is holding.
 
-const { storageGet, storageSet, withLock } = require("../shared/browserApi");
+const { storageGet, storageSet } = require("../shared/browserApi");
 const { normalizePersisted } = require("../shared/persistedState");
 const {
     STATE_SCHEMA_VERSION,
@@ -54,6 +51,11 @@ async function getState() {
     return normalizePersisted(result.autistmask);
 }
 
+// Serializes the read-modify-write turns below. Two of them interleaved would
+// each read before the other wrote, and the second write would carry the first
+// one's fields back to their pre-turn values.
+let updateQueue = Promise.resolve();
+
 async function updateStateOnce(mutate) {
     const s = await getState();
     await mutate(s);
@@ -68,22 +70,27 @@ async function updateStateOnce(mutate) {
 
 // Apply `mutate` to a record read fresh from storage and write the result
 // back. `mutate` receives a detached, normalized profile and mutates it in
-// place; it may be async, but it must not do anything slow. The write is the
-// WHOLE record, which is safe only because the lock (withLock() in
-// src/shared/browserApi.js) is held from the read to the write: two
-// background turns, or a turn and a page's save, never interleave
-// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every page's save waits
-// while it is held, except a page in a Firefox private window, which Firefox
-// gives locks of its own (README, "Stored state and its version").
+// place; it may be async, but it must not do anything slow — the window
+// between the read and the write is the window in which another context's
+// write is lost, and keeping it to one storage round trip is what makes a
+// whole-record write safe here. Concretely: the write is the WHOLE record, so
+// a popup write that lands inside that window is reverted, in every field, by
+// the record this turn read before it. That is accepted because the window is
+// one round trip long and the popup is not writing while the worker is;
+// widening it is what would make it a real hazard.
 //
 // `mutate` must also not call updateState() itself, directly or through
-// anything it awaits: the inner turn waits for the lock the outer one holds,
-// and the outer one is waiting on the inner one. That deadlocks every write of
-// the stored record, not just the caller. Mutate the record you were handed.
+// anything it awaits: the queue is strictly serial, so the inner turn waits on
+// the outer one, which is waiting on the inner one. That deadlocks the whole
+// background, not just the caller. Mutate the record you were handed.
 //
 // Resolves with the record that was written.
 function updateState(mutate) {
-    return withLock("autistmask", () => updateStateOnce(mutate));
+    const turn = updateQueue.then(() => updateStateOnce(mutate));
+    // The queue must advance even when a turn rejects, or every update after
+    // it queues behind a promise that never settles.
+    updateQueue = turn.catch(() => {});
+    return turn;
 }
 
 module.exports = { getState, updateState };

src/popup/index.html

@@ -90,7 +90,7 @@
                 <div id="add-wallet-section-mnemonic">
                     <!-- The die button shares the instruction's row: on a row
                          of its own it pushes Import below the fold at
-                         396x600. -->
+                         360x600. -->
                     <div class="mb-2 flex justify-between items-start gap-2">
                         <p>
                             Enter your 12 or 24 word recovery phrase below, or
@@ -212,7 +212,7 @@
                     />
                 </div>
                 <!-- The error line sits beside Import, not above it: at
-                     396x600 the button already starts near the bottom of
+                     360x600 the button already starts near the bottom of
                      the popup, and a line of its own would push it below
                      the fold. The longest error fits on one line here. -->
                 <div class="flex items-center gap-2">

src/popup/index.js

@@ -5,14 +5,12 @@ const {
     state,
     saveState,
     onSaveFailure,
-    takeStoredNetwork,
     loadState,
 } = require("../shared/state");
 const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
-const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
     $,
     showView,
@@ -24,7 +22,6 @@ const {
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 const {
-    onStorageChanged,
     tabsGetCurrent,
     tabsGetZoom,
     windowsGetCurrent,
@@ -71,55 +68,23 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 
-// The refresh writes into a copy of the wallets. Inside the save, under the
-// lock, its results are copied onto the address records in `state` only if the
-// network it ran on is still the active one, on this page and in the stored
-// record; the background's switch, after the user approves a site's request,
-// reaches this page only after the stored record (followNetworkSwitch() below).
-// A switch while the refresh ran cleared every address's balances
-// (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
-// previous network's must not come back over them
-// (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
-// recorded as done. Results are copied by address, so an address added or
-// removed meanwhile is left as it is.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
-        const networkId = state.networkId;
-        const wallets = structuredClone(state.wallets);
         await Promise.all([
             refreshPrices(),
             refreshBalances(
-                wallets,
+                state.wallets,
                 state.rpcUrl,
                 state.blockscoutUrl,
                 state.trackedTokens,
-                networkId,
+                state.networkId,
                 pageClosed.signal,
             ),
         ]);
-        const refreshed = new Map();
-        for (const wallet of wallets) {
-            for (const addr of wallet.addresses) {
-                refreshed.set(addr.address, addr);
-            }
-        }
-        await saveState((stored) => {
-            if (state.networkId !== networkId) return false;
-            if (stored.networkId !== networkId) return false;
-            for (const wallet of state.wallets) {
-                for (const addr of wallet.addresses) {
-                    const got = refreshed.get(addr.address);
-                    if (!got) continue;
-                    for (const key of ["balance", "ensName", "tokenBalances"]) {
-                        if (got[key] !== undefined) addr[key] = got[key];
-                    }
-                }
-            }
-            state.lastBalanceRefresh = Date.now();
-            return true;
-        });
+        state.lastBalanceRefresh = Date.now();
+        await saveState();
         renderWalletList();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten
@@ -151,7 +116,6 @@ const ctx = {
     renderWalletList,
     doRefreshAndRender,
     startRefresh,
-    restoreView,
     pageClosed: pageClosed.signal,
     showAddWalletView: () => {
         pushCurrentView();
@@ -219,28 +183,6 @@ function fallbackView() {
     showView("main");
 }
 
-// When the background saves a network switch, once the user approves a site's
-// request, or another popup page saves one, this page follows the stored
-// record. It takes the network the record names as a save reads it, holding
-// the lock, so no later save of this page writes the previous network back, and
-// then leaves the page as a switch in Settings leaves it. This page's own
-// switch in Settings is made under the lock as well (onChainSwitch() in
-// src/shared/chainSwitch.js), so a record naming a network other than this
-// page's always holds a switch saved elsewhere, and a switch the user picks
-// here while this waits for the lock is made after it.
-async function followNetworkSwitch() {
-    let switched = false;
-    // A failed save is reported by saveState() itself: see onSaveFailure().
-    await saveState((stored) => {
-        if (stored.networkId === state.networkId) return false;
-        settings.cutViewStack();
-        takeStoredNetwork(stored);
-        clearPopupCaches();
-        switched = true;
-    }).catch(() => {});
-    if (switched) settings.showNewNetwork();
-}
-
 // The background opens the approval window as wide as the page, but the
 // browser counts the window's frame in that width, and a screen taller than
 // the window takes a vertical scrollbar out of it too. So once the screen is
@@ -278,7 +220,7 @@ async function widenApprovalWindow() {
 async function init() {
     // First, before anything can save: showView() saves on every navigation
     // without awaiting, so a save that fails from here on has somewhere to be
-    // reported rather than reaching only the console
+    // reported rather than being swallowed by the save queue
     // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
     // the approval-window branch below too, since that window saves as well.
     //
@@ -385,17 +327,6 @@ async function init() {
     settingsAddToken.init(ctx);
     deleteAddress.init(ctx);
 
-    // Only a record naming a network other than this page's is followed: the
-    // one this page's own switch in Settings saves names the network it
-    // already has, and a record naming none is no switch.
-    onStorageChanged((changes) => {
-        const written = changes.autistmask && changes.autistmask.newValue;
-        if (!written || !written.networkId) return;
-        if (written.networkId !== state.networkId) followNetworkSwitch();
-    });
-    // A switch saved since loadState() above, before there was a listener.
-    followNetworkSwitch();
-
     if (!state.hasWallet) {
         showView("welcome");
     } else {

src/popup/viewRouter.js

@@ -39,8 +39,8 @@ function markViewRendered(view) {
 }
 
 // Begin a fresh page-load scope. The popup gets one by being loaded, and
-// asks for one after a network switch, because every screen then on the page
-// shows the previous network (showNewNetwork() in views/settings.js); the
+// asks for one when the user switches the network, because every screen
+// then on the page shows the previous network (views/settings.js); the
 // unit tests, which simulate several page loads against one module
 // instance, ask for one too.
 function resetRenderedViews() {

src/popup/views/approval.js

@@ -58,15 +58,9 @@ const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
 
 const erc20Iface = new Interface(ERC20_ABI);
 
-// The link opens the explorer of the network with `chainId`, or of the active
-// network when none is given. A chain id that names no network has no
-// explorer, so the address is drawn without a link.
-function approvalAddressHtml(address, chainId) {
+function approvalAddressHtml(address) {
     const title = addressTitle(address, state.wallets);
-    if (chainId && !networkByChainId(chainId)) {
-        return renderAddressHtml(address, { title, noLink: true });
-    }
-    return renderAddressHtml(address, { title, chainId });
+    return renderAddressHtml(address, { title });
 }
 
 // The amount line for a decoded ERC-20 call. With a known scale it is the
@@ -231,11 +225,10 @@ function showTxFee(approvedTx) {
     const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
     // Through formatFee(), as the confirmation screen's fee is, so the same
     // fee reads the same on both. In the native currency of the network shown
-    // above, and at the price on it, as the value is.
+    // above, as the value is.
     $("approve-tx-fee").textContent = formatFee(
         gasLimit * feePerGas,
         nativeCurrencyByChainId(approvedTx.chainId),
-        approvedTx.chainId,
     );
 
     let detail =
@@ -345,14 +338,8 @@ function showTxApproval(details) {
         };
     }
 
-    // Every address link on this screen opens the explorer of the network the
-    // transaction is for, which the Network line names, whichever network is
-    // active.
     $("approve-tx-origin").textContent = details.origin;
-    $("approve-tx-from").innerHTML = approvalAddressHtml(
-        details.approvedFrom,
-        approvedTx.chainId,
-    );
+    $("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
 
     // Show token symbol next to contract address if known on the network the
     // transaction is for
@@ -362,18 +349,17 @@ function showTxApproval(details) {
         if (symbol) {
             toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
         }
-        toHtml += approvalAddressHtml(toAddr, approvedTx.chainId);
+        toHtml += approvalAddressHtml(toAddr);
         $("approve-tx-to").innerHTML = toHtml;
     } else {
         $("approve-tx-to").innerHTML = escapeHtml(CONTRACT_CREATION_TEXT);
     }
 
-    const ethValueFormatted = formatTxValue(ethValue);
-    // Priced from the exact value, not the four-decimal figure, at the price
-    // on the network the transaction is for, as the confirmation screen prices
-    // its amount, so the same value reads the same on both.
-    const ethPrice = getPrice("ETH", approvedTx.chainId);
-    const ethUsd = ethPrice ? parseFloat(ethValue) * ethPrice : null;
+    const ethValueFormatted = formatTxValue(
+        formatEther(approvedTx.value || "0"),
+    );
+    const ethPrice = getPrice("ETH");
+    const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
     const usdStr = formatUsd(ethUsd);
     // In the native currency of the network the transaction is for, which the
     // Network line names, not the active network's: the active network can
@@ -402,10 +388,7 @@ function showTxApproval(details) {
                 if (d.isToken) {
                     detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
                 }
-                detailsHtml += approvalAddressHtml(
-                    d.address,
-                    approvedTx.chainId,
-                );
+                detailsHtml += approvalAddressHtml(d.address);
             } else {
                 detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
             }

src/popup/views/settings.js

@@ -38,8 +38,6 @@ const {
 
 const { notify, sendMessage } = require("../../shared/browserApi");
 
-let ctx;
-
 let versionClickCount = 0;
 let versionClickTimer = null;
 
@@ -245,51 +243,7 @@ async function renderSiteLists() {
     );
 }
 
-// A network switch, made by the user here or saved by the background once the
-// user approved a site's request (src/popup/index.js), leaves every screen on
-// the page showing the previous network. These two leave the page as README's
-// Screen Map describes, the first before the switch is saved, so that save
-// keeps the cut for a popup closed straight after, the second once `state`
-// holds the new network.
-//
-// The stack is cut at the first screen that cannot be rendered from saved
-// state, such as Send or AddToken, and at AddressToken unless it shows the
-// native token: any other token there was picked on the previous network, so
-// it is no longer selected either. Without a wallet the stack starts at
-// Welcome, which that cut would drop, and Welcome shows nothing from a network.
-function cutViewStack() {
-    if (!state.hasWallet) return;
-    if (state.selectedToken !== "ETH") {
-        const tokenView = state.viewStack.indexOf("address-token");
-        if (tokenView !== -1) {
-            state.viewStack = state.viewStack.slice(0, tokenView);
-        }
-        state.selectedToken = null;
-    }
-    state.viewStack = restorableStack(state.viewStack, state.currentView);
-}
-
-// Every screen counts as not yet rendered, so "Back" renders the one it lands
-// on for the new network. Settings on top is brought up to date in place;
-// any other screen is drawn again as a reopened popup draws it, which is Home
-// for one that cannot be rendered from saved state. Without a wallet any other
-// screen is Welcome or AddWallet, which show nothing from a network.
-function showNewNetwork() {
-    resetRenderedViews();
-    if (state.currentView === "settings") {
-        markViewRendered("settings");
-        $("settings-network").value = state.networkId;
-        $("settings-rpc").value = state.rpcUrl;
-        $("settings-blockscout").value = state.blockscoutUrl;
-        renderTrackedTokens();
-    } else if (state.hasWallet) {
-        ctx.restoreView();
-    }
-    updateDebugBanner(state.currentView);
-}
-
-function init(_ctx) {
-    ctx = _ctx;
+function init(ctx) {
     deleteWallet.init(ctx);
     showPhrase.init();
 
@@ -365,18 +319,37 @@ function init(_ctx) {
 
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
-        // Whether `state` already has the network picked is asked only once
-        // the switch holds the lock: while an earlier pick waits for it,
-        // `state` still has the network before that pick, and a pick back to
-        // that network must still be made.
         const newId = networkSelect.value;
-        cutViewStack();
+        if (newId === state.networkId) return;
+        // The screens beneath Settings show the previous network, so Back
+        // finds them as it does in a reopened popup: each is rendered again
+        // when Back lands on it, and the stack is cut at the first one that
+        // cannot be rendered from saved state, such as Send or AddToken. It
+        // is cut at AddressToken too, unless that shows the native token: any
+        // other token there was picked on the previous network. Without a
+        // wallet the stack starts at Welcome, which that cut would drop, and
+        // Welcome shows nothing from a network. The cut comes before the
+        // switch so that the switch's save keeps it for a popup closed
+        // straight after.
+        if (state.hasWallet) {
+            const tokenView = state.viewStack.indexOf("address-token");
+            if (tokenView !== -1 && state.selectedToken !== "ETH") {
+                state.viewStack = state.viewStack.slice(0, tokenView);
+            }
+            state.viewStack = restorableStack(state.viewStack, "settings");
+        }
         const net = await onChainSwitch(newId);
-        if (!net) return;
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        showNewNetwork();
+        resetRenderedViews();
+        // Settings itself, and the testnet banner above it, are brought up
+        // to date for the new network here.
+        markViewRendered("settings");
+        $("settings-rpc").value = state.rpcUrl;
+        $("settings-blockscout").value = state.blockscoutUrl;
+        renderTrackedTokens();
+        updateDebugBanner(state.currentView);
         showFlash("Switched to " + net.name + ".");
     });
 
@@ -511,10 +484,4 @@ function init(_ctx) {
     });
 }
 
-module.exports = {
-    init,
-    show,
-    renderSiteLists,
-    cutViewStack,
-    showNewNetwork,
-};
+module.exports = { init, show, renderSiteLists };

src/popup/views/stateRecovery.js

@@ -24,11 +24,7 @@
 // than written again locally so that tests/popupElementIds.test.js sees these
 // lookups and holds every id below against the markup.
 const { $, VIEWS } = require("./helpers");
-const {
-    storageGet,
-    storageRemove,
-    withLock,
-} = require("../../shared/browserApi");
+const { storageGet, storageRemove } = require("../../shared/browserApi");
 const { log } = require("../../shared/log");
 
 // Typed in full before anything is erased, in the same spirit as the wallet
@@ -141,11 +137,7 @@ async function resetProfile() {
         return;
     }
     try {
-        // Under the lock every write of the stored record takes, so the erase
-        // cannot land between another write's read and its write and be undone.
-        // A page in a Firefox private window is the exception: Firefox gives
-        // it locks of its own (README, "Stored state and its version").
-        await withLock("autistmask", () => storageRemove("autistmask"));
+        await storageRemove("autistmask");
     } catch (e) {
         log.errorf("state recovery: reset failed:", e);
         setFlash("The saved data could not be erased. Nothing was changed.");

src/shared/balances.js

@@ -1,5 +1,4 @@
-// Balance fetching: ETH balances and the balances of the tokens the user
-// tracks via RPC, the other ERC-20 token balances and the holder counts via
+// Balance fetching: ETH balances via RPC, ERC-20 token balances via
 // Blockscout, ENS reverse lookup via RPC.
 
 const {
@@ -82,9 +81,7 @@ function rawUnits(value) {
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
-// balance is read through the RPC endpoint instead, and its row here gives that
-// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
+// explicitly tracked by the user, or have >= 1000 holders.
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -208,96 +205,8 @@ async function fetchTokenBalances(
     }
 }
 
-// The entries at `address` of the tokens the user tracks, shaped as
-// fetchTokenBalances() returns them, for the tokens the address holds.
-//
-// The balance is read with balanceOf through the RPC endpoint. The name and
-// symbol are the tracked token's. `decimals` and `holders` are those of
-// Blockscout's entry for the token in `explorerRequest`, this refresh's
-// fetchTokenBalances() for the address; while Blockscout fails they are kept
-// from the token's entry in `previous`, the address's entries before this
-// refresh. The balance is stated at the scale the screens read the token at
-// (resolveTokenDecimals()): the bundled list's, then the one the tracked token
-// records, then Blockscout's, as in fetchTokenBalances().
-//
-// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
-// balance keeps its figure, or takes Blockscout's entry from this refresh when
-// it has none. The failure is logged. A balance of zero gets no entry, as a
-// zero Blockscout reports gets none: the balance lists take a tracked token's
-// zero from the tracked list. A token whose symbol the spoof rule refuses gets
-// no entry either, as in fetchTokenBalances().
-//
-// `signal` is as for fetchTokenBalances().
-async function fetchTrackedTokenBalances(
-    provider,
-    address,
-    trackedTokens,
-    previous,
-    explorerRequest,
-    signal,
-) {
-    const listed = trackedTokens.filter(
-        (token) => !isSpoofedSymbol(token.symbol, token.address),
-    );
-    // Each token's balanceOf answer, or null where it failed.
-    const balances = await Promise.all(
-        listed.map(async (token) => {
-            try {
-                const contract = new Contract(
-                    token.address,
-                    ERC20_ABI,
-                    provider,
-                );
-                return await contract.balanceOf(address);
-            } catch (e) {
-                if (!signal?.aborted) {
-                    log.errorf(
-                        "token balance failed",
-                        address,
-                        token.address,
-                        e.shortMessage || e.message,
-                    );
-                }
-                return null;
-            }
-        }),
-    );
-    const explorerRows = await explorerRequest;
-    const reported = explorerRows ?? previous;
-
-    const rows = [];
-    listed.forEach((token, i) => {
-        const lower = token.address.toLowerCase();
-        const entryIn = (list) =>
-            list.find((row) => String(row.address).toLowerCase() === lower);
-        const raw = balances[i];
-        if (raw === null) {
-            const kept = entryIn(previous) || entryIn(explorerRows || []);
-            if (kept) rows.push(kept);
-            return;
-        }
-        if (raw === 0n) return;
-        const entry = entryIn(reported);
-        const decimals = entry ? entry.decimals : null;
-        const known = resolveTokenDecimals(lower, { trackedTokens });
-        const scale = known !== null ? known : decimals;
-        rows.push({
-            address: token.address,
-            name: token.name || "",
-            symbol: token.symbol || "???",
-            decimals: decimals,
-            // null when nothing knows the scale: a holding whose amount
-            // cannot be stated, never a zero.
-            balance: scale === null ? null : formatTokenBalance(raw, scale),
-            holders: entry ? entry.holders : null,
-        });
-    });
-    return rows;
-}
-
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
-// `trackedTokens` are the tokens tracked on the active network. `signal` is as
-// for fetchTokenBalances().
+// `signal` is as for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
@@ -308,8 +217,6 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
-    const tracked = trackedTokens || [];
-    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
 
     for (const wallet of wallets) {
@@ -359,42 +266,23 @@ async function refreshBalances(
                     }),
             );
 
-            // ERC-20 token balances: the tracked tokens' through the RPC
-            // endpoint, and from Blockscout the tokens the user has not
-            // tracked. When Blockscout fails, the untracked rows from before
-            // this refresh stay. The Blockscout request is started first and
-            // handed to fetchTrackedTokenBalances() too, which waits for it
-            // after sending its balanceOf reads, so the two run side by side.
-            const previous = addr.tokenBalances || [];
-            const explorerRequest = fetchTokenBalances(
-                addr.address,
-                blockscoutUrl,
-                tracked,
-                signal,
-            );
+            // ERC-20 token balances via Blockscout
             updates.push(
-                Promise.all([
-                    fetchTrackedTokenBalances(
-                        provider,
-                        addr.address,
-                        tracked,
-                        previous,
-                        explorerRequest,
-                        signal,
-                    ),
-                    explorerRequest,
-                ]).then(([trackedRows, explorerRows]) => {
-                    const untrackedRows = (explorerRows ?? previous).filter(
-                        (row) =>
-                            !trackedSet.has(String(row.address).toLowerCase()),
-                    );
-                    addr.tokenBalances = trackedRows.concat(untrackedRows);
-                    log.debugf(
-                        "Token balances",
-                        addr.address,
-                        addr.tokenBalances.length,
-                        "tokens",
-                    );
+                fetchTokenBalances(
+                    addr.address,
+                    blockscoutUrl,
+                    trackedTokens,
+                    signal,
+                ).then((balances) => {
+                    if (balances !== null) {
+                        addr.tokenBalances = balances;
+                        log.debugf(
+                            "Token balances",
+                            addr.address,
+                            balances.length,
+                            "tokens",
+                        );
+                    }
                 }),
             );
         }

src/shared/browserApi.js

@@ -31,11 +31,6 @@
 // Everything is resolved on use rather than captured at module load. The MV3
 // service worker is torn down and re-evaluated repeatedly, and the unit
 // suite installs its stubs on `global.chrome` around a require().
-//
-// The module also holds withLock(), a wrapper around the browser's
-// `navigator.locks`, which is in neither namespace. It sits beside
-// storageGet() and storageSet() because every write of the stored record
-// takes it.
 
 // The extension API namespace, preferring `browser.*` where it exists.
 //
@@ -224,46 +219,6 @@ function storageRemove(keys) {
     return Promise.resolve(storage.remove(keys));
 }
 
-/**
- * Call `listener` after every write to `storage.local`, whether this page,
- * another page or the background made it, with what the write changed, as the
- * browser reports it: `{ [key]: { oldValue, newValue } }`.
- *
- * @param {function(Object): void} listener
- */
-function onStorageChanged(listener) {
-    namespaceMember("storage").onChanged.addListener((changes, areaName) => {
-        if (areaName === "local") listener(changes);
-    });
-}
-
-/**
- * Run `fn` while holding the browser's lock called `name`
- * (`navigator.locks`), and settle as `fn` settles. Every page of the extension
- * and its background share these locks, except a page in a Firefox private
- * window (README, "Stored state and its version"), so while one of them holds
- * `name` another asking for it waits, in the order they asked. The lock is let
- * go when `fn` settles, whether it resolved or rejected.
- *
- * Every write of the stored record holds the lock named after its key,
- * "autistmask", from its read to its write: saveState() in
- * src/shared/state.js, updateState() in src/background/state.js, and the
- * reset in src/popup/views/stateRecovery.js.
- *
- * @param {string} name
- * @param {function(): Promise<*>} fn
- * @returns {Promise<*>} what `fn` resolved with.
- * @throws rejects, without running `fn`, where `navigator.locks` is absent.
- */
-function withLock(name, fn) {
-    if (typeof navigator === "undefined" || !navigator.locks) {
-        return Promise.reject(
-            new Error("navigator.locks is not available in this context"),
-        );
-    }
-    return navigator.locks.request(name, () => fn());
-}
-
 // `storage.session`, the browser's session storage: what is kept there lasts
 // until the browser closes. It survives the background worker being stopped
 // and started again, which module-level variables do not (README, Background
@@ -398,7 +353,6 @@ module.exports = {
     getPlatformInfo,
     hasBrowserNamespace,
     notify,
-    onStorageChanged,
     runtimeApi,
     sendMessage,
     sessionStorageGet,
@@ -419,5 +373,4 @@ module.exports = {
     windowsGetLastFocused,
     windowsRemove,
     windowsUpdate,
-    withLock,
 };

src/shared/chainSwitch.js

@@ -1,18 +1,8 @@
-// The popup's network switch.
+// Consolidated chain-switch handler for the popup.
 //
-// A network switch reaches the popup's `state` in one of two ways:
-//
-// - onChainSwitch() below makes the switch the user picks in Settings, with
-//   applyChainSwitchFields() (chainSwitchFields.js).
-// - followNetworkSwitch() in src/popup/index.js takes a switch the background
-//   or another popup page saved, from the stored record, with
-//   takeStoredNetwork() (state.js), which copies it with
-//   copyChainSwitchFields() (chainSwitchFields.js).
-//
-// Both change `state` inside a save, holding the lock, and both reset the
-// popup's own caches through clearPopupCaches(), so a reset added there
-// reaches both. A field applyChainSwitchFields() sets has to be copied by
-// copyChainSwitchFields() too.
+// Every state change required when the active network changes is
+// performed here so that callers (settings UI, future chain additions) all go
+// through a single code path.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
@@ -30,32 +20,22 @@
 const { applyChainSwitchFields } = require("./chainSwitchFields");
 const { clearPrices } = require("./prices");
 
-// The popup's own caches a network switch resets. Prices are chain-specific
-// (testnet tokens are worthless, ETC has different pricing, etc.). In-memory
-// and per bundle, so this is the popup's own cache — the only context that
-// ever fills it.
-function clearPopupCaches() {
-    clearPrices();
-}
-
 // Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain, or null when
-// `state` already has that network once the save holds the lock, and nothing
-// is switched.
-//
-// `state` is switched inside the save that stores the switch, holding the
-// lock, so it is never switched while a follow of a switch saved elsewhere
-// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
-// follow runs first, and this switch is made after it.
+// Returns the network configuration object for the new chain.
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");
-    let net = null;
-    await saveState(() => {
-        if (state.networkId === newNetworkId) return false;
-        net = applyChainSwitchFields(state, newNetworkId);
-        clearPopupCaches();
-    });
+
+    const net = applyChainSwitchFields(state, newNetworkId);
+
+    // --- price cache ---
+    // Prices are chain-specific (testnet tokens are worthless,
+    // ETC has different pricing, etc.). In-memory and per bundle, so this is
+    // the popup's own cache — the only context that ever fills it.
+    clearPrices();
+
+    await saveState();
+
     return net;
 }
 
-module.exports = { onChainSwitch, clearPopupCaches };
+module.exports = { onChainSwitch };

src/shared/chainSwitchFields.js

@@ -7,7 +7,7 @@
 // the singleton and saves; the background applies it to the detached record of
 // its own read-modify-write (src/background/state.js).
 //
-// Everything here is synchronous and touches nothing but the objects it is
+// Everything here is synchronous and touches nothing but the object it is
 // given: no storage, no caches, no imports beyond the network table. That is
 // what makes it usable on a record that has been read fresh from storage
 // microseconds earlier and is about to be written back.
@@ -76,33 +76,4 @@ function applyChainSwitchFields(s, newNetworkId) {
     return net;
 }
 
-// Give `s` every field applyChainSwitchFields() sets, as `switched` holds it:
-// the popup takes a switch the background saved from the stored record this
-// way, rather than performing it again (takeStoredNetwork() in
-// src/shared/state.js). Balances are taken by address, and an address
-// `switched` does not have keeps none.
-function copyChainSwitchFields(s, switched) {
-    s.networkEndpoints = switched.networkEndpoints;
-    s.networkTrackedTokens = switched.networkTrackedTokens;
-    s.trackedTokens = switched.trackedTokens;
-    s.networkId = switched.networkId;
-    s.rpcUrl = switched.rpcUrl;
-    s.blockscoutUrl = switched.blockscoutUrl;
-    s.lastBalanceRefresh = switched.lastBalanceRefresh;
-    s.tokenHolderCache = switched.tokenHolderCache;
-    s.fraudContracts = switched.fraudContracts;
-
-    const stored = new Map();
-    for (const wallet of switched.wallets) {
-        for (const addr of wallet.addresses) stored.set(addr.address, addr);
-    }
-    for (const wallet of s.wallets) {
-        for (const addr of wallet.addresses) {
-            const got = stored.get(addr.address);
-            addr.balance = got ? got.balance : "0";
-            addr.tokenBalances = got ? got.tokenBalances : [];
-        }
-    }
-}
-
-module.exports = { applyChainSwitchFields, copyChainSwitchFields };
+module.exports = { applyChainSwitchFields };

src/shared/prices.js

@@ -38,12 +38,11 @@ function clearPrices() {
 }
 
 // Return the USD price for a symbol on the network with `chainId`, or on the
-// active network when no chain id is given; null on testnet, on a chain id
-// that names no network, or for a symbol with no price.
+// active network when no chain id is given; null on testnet / unknown.
 function getPrice(symbol, chainId) {
     const { currentNetwork } = require("./state");
     const network = chainId ? networkByChainId(chainId) : currentNetwork();
-    if (!network || network.isTestnet) return null;
+    if (network.isTestnet) return null;
     return prices[symbol] || null;
 }
 

src/shared/state.js

@@ -23,7 +23,6 @@
 // guarantee.
 
 const { networkById } = require("./networks");
-const { copyChainSwitchFields } = require("./chainSwitchFields");
 const {
     DEFAULT_STATE,
     PERSISTED_FIELDS,
@@ -36,7 +35,7 @@ const {
     migrationNeeded,
 } = require("./stateSchema");
 
-const { storageGet, storageSet, withLock } = require("./browserApi");
+const { storageGet, storageSet } = require("./browserApi");
 const { log } = require("./log");
 
 // The live record the proxy below guards. Everything inside this module reads
@@ -126,10 +125,8 @@ function currentNetwork() {
 }
 
 // The persisted fields as this page held them when its last loadState()
-// finished, or when its last successful saveState() began, with any network
-// switch saved elsewhere that this page has taken since (takeStoredNetwork()).
-// saveState() diffs the live state against this to find only the fields THIS
-// page changed since.
+// finished, or when its last successful saveState() began. saveState() diffs
+// the live state against this to find only the fields THIS page changed since.
 //
 // Deep-cloned, not a reference: callers mutate persisted objects and arrays
 // in place (state.wallets.push(...)), and a reference baseline would mutate
@@ -461,18 +458,20 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // This page's own live `state` is deliberately NOT rehydrated from a field
 // another page changed — only the record written to storage is merged.
 // showView() fires saveState() on every navigation without awaiting it,
-// which is why saves from one page wait for each other (see saveState()), and
-// a save that is slow to come back has no way to tell whether the field it
+// which is what makes the queue above necessary in the first place, and a
+// save that is slow to come back has no way to tell whether the field it
 // is about to hand back is still the current answer or has since been
 // overtaken by something this very page did in the meantime; writing it
 // into `state` regardless reintroduced exactly the clobber this function
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current. The
-// network is the exception: the popup takes a switch another context saved
-// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
-async function saveStateOnce(beforeWrite) {
+// before this fix; only the persisted record is guaranteed current.
+async function saveStateOnce() {
+    // A copy, so what this save compares and writes is the page's state as it
+    // stood when the save began. A change made while it waits on storage is
+    // left for the next save, which compares against this copy.
+    const current = structuredClone(snapshotPersisted());
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written
     // back, so it is validated exactly like a load validates it. Without this,
@@ -486,12 +485,6 @@ async function saveStateOnce(beforeWrite) {
     // come from storage in its loaded (self-healed) shape. See
     // normalizePersisted() in persistedState.js.
     const fresh = normalizePersisted(result.autistmask);
-    if (beforeWrite && beforeWrite(fresh) === false) return;
-
-    // A copy, so what this save compares and writes is the page's state as it
-    // stood once the stored record was read. A change made while it waits on
-    // the write is left for the next save, which compares against this copy.
-    const current = structuredClone(snapshotPersisted());
 
     const merged = { ...fresh };
     for (const key of PERSISTED_FIELDS) {
@@ -536,21 +529,35 @@ async function saveStateOnce(beforeWrite) {
     rawState.hasWallet = rawState.wallets.length > 0;
 
     // What this save compared and wrote, not the page's state now: a change
-    // made during the save must still differ from the baseline, or the next
-    // save finds nothing to store
+    // made during the save must still differ from the baseline, or the save
+    // queued after it finds nothing to store
     // (https://git.eeqj.de/sneak/AutistMask/issues/448).
     baseline = current;
 }
 
+// showView() calls saveState() on every navigation without awaiting it, so
+// two saves from the SAME page can be in flight at once — e.g. a screen
+// shown, then immediately replaced before the first save's storageGet()
+// round trip has come back. Left concurrent, the first save's turn would
+// finish after the second's live-state mutation and then re-hydrate `state`
+// from what IT read, stomping the second, later change back to a stale
+// value — the same clobber this function exists to prevent, just between
+// two saves on one page instead of two pages. Queuing makes every save's
+// snapshot-diff-write-rehydrate run start to finish before the next one
+// begins, so each one only ever sees the true live state at its turn.
+let saveQueue = Promise.resolve();
+
 // Where a failed save is REPORTED, set once by the context that has a screen
 // to say it on (src/popup/index.js).
 //
 // A save that fails must not fail silently. showView() fires saveState() on
-// every navigation without awaiting it, and `await saveState()` inside an
-// unguarded event handler is no better: either way, without this, a failure
-// would reach only the console, where the user never looks, and the wallet
-// would keep running against storage that rejects every write. That is the
-// data-loss half of https://git.eeqj.de/sneak/AutistMask/issues/362.
+// every navigation without awaiting it, and the queue below has to attach a
+// rejection handler to keep advancing — so a failing save was swallowed
+// entirely: no throw, no message, nothing on screen. The wallet kept running
+// against storage that was rejecting every write, which is the data-loss half
+// of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
+// no better off: `await saveState()` inside an unguarded event handler surfaces
+// in the console and nowhere the user looks.
 //
 // This is the "tell the user" half; the other half is the floor in
 // normalizePersisted(), which stops the malformed-record cause from arising in
@@ -576,25 +583,11 @@ function reportSaveFailure(err) {
     }
 }
 
-// Each save runs start to finish holding the lock every write of the stored
-// record takes (withLock() in src/shared/browserApi.js), so no write by
-// another page or the background lands between its read and its write and is
-// lost (https://git.eeqj.de/sneak/AutistMask/issues/641). A page in a Firefox
-// private window is the exception: Firefox gives it locks of its own (README,
-// "Stored state and its version").
-//
-// The same lock orders this page's own saves. showView() calls saveState() on
-// every navigation without awaiting it, so two saves from one page can be
-// asked for at once; they take the lock in the order they were asked, and each
-// compares the page's state, as it stands once the stored record has been read
-// and `beforeWrite` has run, against the baseline the save before it left.
-//
-// `beforeWrite`, when given, is called inside the lock with the stored record
-// as just read, before this page's state is compared against it. It may change
-// `state`, and this save writes that change. When it returns false, nothing is
-// written; any other return lets the save go ahead.
-function saveState(beforeWrite) {
-    const turn = withLock("autistmask", () => saveStateOnce(beforeWrite));
+function saveState() {
+    const turn = saveQueue.then(saveStateOnce);
+    // The queue must advance even when a save rejects, or every save after
+    // it queues behind a promise that never settles.
+    saveQueue = turn.catch(() => {});
     // Every failed save is reported, whether or not the caller awaited this
     // one. The returned promise still rejects, so a caller that DOES await
     // keeps its own error handling.
@@ -602,17 +595,6 @@ function saveState(beforeWrite) {
     return turn;
 }
 
-// Give this page the network switch held by `stored`, a record a save of this
-// page has just read (followNetworkSwitch() in src/popup/index.js calls this
-// from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
-// with a whole record. The switch is then not this page's own change, even when
-// that save fails to write: a later switch back to the previous network still
-// differs from `baseline`, and is stored.
-function takeStoredNetwork(stored) {
-    copyChainSwitchFields(rawState, stored);
-    copyChainSwitchFields(baseline, structuredClone(stored));
-}
-
 // Rejects with StateUnusableError for a stored record this build cannot make
 // sense of. Nothing is assigned and `loaded` stays false in that case, so a
 // caller that ignores the rejection gets StateNotLoadedError on the first
@@ -658,7 +640,6 @@ module.exports = {
     state,
     saveState,
     onSaveFailure,
-    takeStoredNetwork,
     loadState,
     currentAddress,
     currentNetwork,

src/shared/transactions.js

@@ -20,7 +20,6 @@ const { toDecimals } = require("./transferAmount");
 // truncation without the approval screens' nonzero floor: the transaction
 // detail view is the authoritative record and already shows exact precision.
 const { truncateAmount: formatTxValue } = require("./amountDisplay");
-const { routerRelease } = require("./uniswap");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -52,6 +51,7 @@ function parseTx(tx, addrLower, chainId) {
         }
         // Map known DEX methods to "Swap" for cleaner display
         const SWAP_METHODS = new Set([
+            "execute",
             "swap",
             "swapExactTokensForTokens",
             "swapTokensForExactTokens",
@@ -59,16 +59,9 @@ function parseTx(tx, addrLower, chainId) {
             "swapTokensForExactETH",
             "swapExactTokensForETH",
             "swapETHForExactTokens",
+            "multicall",
         ]);
-        // Multisigs, smart accounts and many other contracts also have an
-        // `execute` or `multicall` method, so either is a swap only when sent
-        // to a Universal Router on this transaction's network: the same
-        // addresses the approval screen decodes a swap for.
-        const isSwap =
-            SWAP_METHODS.has(method) ||
-            ((method === "execute" || method === "multicall") &&
-                routerRelease(to, chainId) !== null);
-        const label = isSwap
+        const label = SWAP_METHODS.has(method)
             ? "Swap"
             : method.charAt(0).toUpperCase() + method.slice(1);
         direction = "contract";

src/shared/uniswap.js

@@ -336,8 +336,7 @@ const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
 // currencies, and those commands may name one, so saying the calldata did not
 // name it would be false. The Paid to line uses it too, when a step may pay an
 // address this decoder did not read, and so do the lines for what a step
-// takes from the sender, when this decoder does not know it, and for what a
-// permit it could not read allows.
+// takes from the sender, when this decoder does not know it.
 const UNDECODED_CURRENCY = "Unknown (could not be decoded)";
 
 // The Paid to line for each token paid to the router, the swap's output or
@@ -495,9 +494,8 @@ function amountText(raw, info) {
     };
 }
 
-// The line giving a moved token, or the token of a permit, under `label`, in
-// the shape of the Token In line, so the screens show it as they show that
-// one. ETH has no address.
+// The line giving a moved token under `label`, in the shape of the Token In
+// line, so the screens show it as they show that one. ETH has no address.
 function tokenMovedLine(label, token, sources) {
     const info = tokenInfo(token, sources);
     if (!present(info.address)) {
@@ -529,32 +527,6 @@ function decodePermit2(input) {
     }
 }
 
-// Decode PERMIT2_PERMIT_BATCH (command 0x03) input bytes into the allowances
-// it grants, one for each token it names, all for its one spender, in the
-// shape decodePermit2() returns. Each release's
-// `contracts/base/Dispatcher.sol`, at the commit linked for it above, hands
-// Permit2 the batch in this shape.
-// ABI: (((address token, uint160 amount, uint48 expiration, uint48 nonce)[],
-//        address spender, uint256 sigDeadline), bytes signature)
-function decodePermit2Batch(input) {
-    try {
-        const d = coder.decode(
-            [
-                "tuple(tuple(address,uint160,uint48,uint48)[],address,uint256)",
-                "bytes",
-            ],
-            input,
-        );
-        return d[0][0].map((details) => ({
-            token: details[0],
-            amount: details[1],
-            spender: d[0][1],
-        }));
-    } catch {
-        return null;
-    }
-}
-
 // Decode BALANCE_CHECK_ERC20 (command 0x0e) input bytes. The router passes the
 // check when `owner` holds at least `minBalance` of `token`, and reads `owner`
 // as written, without map(), on every release that has the command:
@@ -620,19 +592,13 @@ function decodeV2SwapExactOut(input) {
     }
 }
 
-// The first and last token of a V3 swap path (packed: token(20) + fee(3) +
-// token(20) ...), or null when it is not one token followed by whole hops of
-// a fee and a token (40 hex digits, then 46 per hop). The router reads only
-// whole hops and ignores any bytes after the last one, so the last 20 bytes
-// of such a path are not the token it reads there. Both are checksummed, as
-// the ABI decoder gives every other address, so a token reads the same on
-// every line.
+// Decode V3 swap path (packed: token(20) + fee(3) + token(20) ...)
 function decodeV3Path(pathHex) {
     const hex = pathHex.startsWith("0x") ? pathHex.slice(2) : pathHex;
-    if (hex.length < 40 || (hex.length - 40) % 46 !== 0) return null;
-    const first = getAddress("0x" + hex.slice(0, 40));
-    const last = getAddress("0x" + hex.slice(-40));
-    return { first, last };
+    if (hex.length < 40) return null;
+    const tokenIn = "0x" + hex.slice(0, 40);
+    const tokenOut = "0x" + hex.slice(-40);
+    return { tokenIn, tokenOut };
 }
 
 // Decode V3_SWAP_EXACT_IN (command 0x00) input bytes.
@@ -651,39 +617,8 @@ function decodeV3SwapExactIn(input) {
             recipient: d[0],
             amountIn: d[1],
             amountOutMin: d[2],
-            tokenIn: path.first,
-            tokenOut: path.last,
-            payerIsUser: d[4],
-        };
-    } catch {
-        return null;
-    }
-}
-
-// Decode V3_SWAP_EXACT_OUT (command 0x01) input bytes.
-// ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
-//        bytes path, bool payerIsUser)
-// The router reads an exact-out path from the token it buys to the token it
-// spends: it buys `amountOut` of the path's first token from the path's first
-// pool and pays at most `amountInMax` of its last token to its last pool
-// (`v3SwapExactOutput()` and `uniswapV3SwapCallback()` in each release's
-// `contracts/modules/uniswap/v3/V3SwapRouter.sol`, at the commit linked for
-// it above).
-// With `payerIsUser` false the router pays the input from its own balance.
-function decodeV3SwapExactOut(input) {
-    try {
-        const d = coder.decode(
-            ["address", "uint256", "uint256", "bytes", "bool"],
-            input,
-        );
-        const path = decodeV3Path(d[3]);
-        if (!path) return null;
-        return {
-            recipient: d[0],
-            amountOut: d[1],
-            amountInMax: d[2],
-            tokenIn: path.last,
-            tokenOut: path.first,
+            tokenIn: path.tokenIn,
+            tokenOut: path.tokenOut,
             payerIsUser: d[4],
         };
     } catch {
@@ -953,9 +888,7 @@ function totalAmount(amounts) {
 // 2. Amount is the amountIn of the swap action that spends Token In. If
 //    several exact-in actions spend it, each with a stated amount, it is
 //    their sum; in any other case there is none. Min. received is the same
-//    for amountOutMin and the actions that buy Token Out, except that there
-//    is none when a swap action in the step also spends Token Out: the step
-//    then does not pay out all that those actions buy.
+//    for amountOutMin and the actions that buy Token Out.
 // 3. If any swap action in the step cannot be read, only SETTLE, SETTLE_ALL,
 //    TAKE and TAKE_ALL name the sides, and there is no Amount or Min.
 //    received.
@@ -970,10 +903,8 @@ function totalAmount(amounts) {
 // input side from it only when no earlier step set it. A side it sets that
 // these rules leave unknown is set unknown, with no figure. A step with no
 // swap action sets only the sides SETTLE, SETTLE_ALL, TAKE and TAKE_ALL
-// name. Under each of the three rules, rule 3 included, when the user pays
-// the step any of Token In (`paidByUser` below), decode() takes what the user
-// pays it of Token In as the step's amount in place of the rules' Amount, or
-// no amount when this decoder cannot tell what that is.
+// name. When the user pays the step any of Token In (`paidByUser` below),
+// decode() takes that, not the Amount of rule 2, as the step's amount.
 //
 // `takes` is every TAKE, TAKE_ALL and TAKE_PORTION, as the currency it takes
 // and its recipient as written, MSG_SENDER for a TAKE_ALL. TAKE_PORTION takes
@@ -1189,13 +1120,11 @@ function decodeV4Swap(input) {
         const boughtOnly = currenciesNotIn(bought, spent);
         if (present(takeToken) || boughtOnly.length === 1) {
             tokenOut = present(takeToken) ? takeToken : boughtOnly[0];
-            if (!spent.includes(tokenOut)) {
-                amountOutMin = totalAmount(
-                    swaps
-                        .filter((s) => s.tokenOut === tokenOut)
-                        .map((s) => s.amountOutMin),
-                );
-            }
+            amountOutMin = totalAmount(
+                swaps
+                    .filter((s) => s.tokenOut === tokenOut)
+                    .map((s) => s.amountOutMin),
+            );
         }
 
         return {
@@ -1238,22 +1167,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         let inputToken = null;
         let inputAmount = null;
         let inputEstablished = false;
-        // Whether the user pays the step that set the input side: a V2 or V3
-        // swap step with `payerIsUser` true, a V4 step the user pays some of
-        // its input currency (see decodeV4Swap()), or a WRAP_ETH, whose ETH
-        // comes from the transaction's value. A step paid from the router
-        // takes nothing from the sender.
-        let inputPaidByUser = false;
-        // The last PERMIT2_PERMIT this decoder read before a step set the
-        // input side, or null (see permitStands after the loop).
+        // The last PERMIT2_PERMIT this decoder read, or null (see
+        // permitStands after the loop).
         let permit = null;
-        // Every allowance a PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH grants,
-        // before a step set the input side or after, in step order, as
-        // { token, amount, spender, step }. A permit or batch whose input
-        // this decoder cannot read is one with a null token, amount and
-        // spender. Each but a permit whose amount is the Amount figure gets
-        // lines of its own (see after the PERMIT2_TRANSFER_FROM lines).
-        const permits = [];
         // The index of each step this decoder did not read in full: a
         // command it does not read, a step whose input it cannot read, in
         // whole or in part, and one it fails on (see permitStands).
@@ -1262,32 +1178,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         let minOutput = null;
         let outputEstablished = false;
         let hasUnwrapWeth = false;
-        // Set when an UNWRAP_WETH pays out, as ETH, the output side's WETH,
-        // which the router holds; cleared whenever the output side is set
-        // again, or a later step may pay that ETH out as WETH (see after the
-        // loop). `unwrapIntoRouterStep` is the index of the first such
-        // UNWRAP_WETH that may have paid the ETH to the router, which then
-        // holds it: its recipient is the router or cannot be read. A later
-        // UNWRAP_WETH does not replace it. It is null when there is none, and
-        // is cleared with `outputUnwrapped` when the output side is set again.
-        let outputUnwrapped = false;
-        let unwrapIntoRouterStep = null;
-        // The index of the step that set the output side.
-        let outputStep = -1;
-        // The index of the last step this decoder treats as one that may take
-        // WETH out of the router or pay anyone WETH: any step but one it read
-        // that is a PERMIT2_PERMIT, a BALANCE_CHECK_ERC20, or a SWEEP,
-        // TRANSFER, PAY_PORTION or PAY_PORTION_FULL_PRECISION of a token
-        // other than WETH, and not of ETH to a WETH contract, which pays the
-        // router WETH (see keepsRouterWeth in the loop). None of those can.
-        let lastWethStep = -1;
-        // Where the step that set the output side paid its output: the
-        // recipient of a swap step, as written, or of each TAKE, TAKE_ALL and
-        // TAKE_PORTION of it in a V4 step, a TAKE_ALL as paid to the sender,
-        // with null for a payout of that step this decoder did not read. A
-        // BALANCE_CHECK_ERC20 pays nobody.
-        let outputRecipients = [];
-        let hasV2OrV3ExactOut = false;
+        let hasV2ExactOut = false;
         let swapUndecoded = false;
         let hasSubPlan = false;
         const commandNames = [];
@@ -1311,9 +1202,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // when no earlier hop set it. A half the establishing hop did not
         // state stays null and the line says so, rather than being filled in
         // from a different hop. A PERMIT2_PERMIT sets no side here: after the
-        // loop, one whose amount stands as the Amount figure names Token In,
-        // and the Amount line is formed there, in one place (see
-        // permitStands).
+        // loop, the last one read names Token In, and the Amount line is
+        // formed there, in one place (see permitStands).
         const setInput = (token, amount) => {
             inputToken = present(token) ? token : null;
             inputAmount = present(amount) ? amount : null;
@@ -1324,15 +1214,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (!present(token) && !present(amount)) return;
             setInput(token, amount);
         };
-        const setOutput = (step, token, amount, recipients) => {
+        const setOutput = (token, amount) => {
             if (!present(token) && !present(amount)) return;
             outputToken = present(token) ? token : null;
             minOutput = present(amount) ? amount : null;
             outputEstablished = true;
-            outputUnwrapped = false;
-            unwrapIntoRouterStep = null;
-            outputRecipients = recipients;
-            outputStep = step;
         };
 
         // What the steps take from the sender beyond the amount of the step
@@ -1348,8 +1234,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         };
         // A step may take from the sender what this decoder did not read: a
         // V4 step whose input or one of whose SETTLEs or SETTLE_ALLs it
-        // cannot read; a V2 or V3 swap step or PERMIT2_TRANSFER_FROM whose
-        // input it cannot read; a PERMIT2_TRANSFER_FROM_BATCH; an
+        // cannot read; a V2 or V3 exact-in or V2 exact-out step or
+        // PERMIT2_TRANSFER_FROM whose input it cannot read; a
+        // PERMIT2_TRANSFER_FROM_BATCH; a V3_SWAP_EXACT_OUT; an
         // EXECUTE_SUB_PLAN; and a step it fails on. It is recorded with a null
         // token and amount: one line says so, there is no Amount line, whose
         // figure may then be too low, and the amount of a permit after it
@@ -1357,15 +1244,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         const spentUnread = () => {
             userPaid.push({ token: null, amount: null });
         };
-        // A PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH at `step` whose input this
-        // decoder cannot read may let any spender take any amount of any
-        // token: one line says so, there is no Amount line, whose figure may
-        // then be too low, and the minimum reads Min. paid out (see
-        // toAnotherSpender).
-        const permitUnread = (step) => {
-            permits.push({ token: null, amount: null, spender: null, step });
-            stepsUnread.push(step);
-        };
 
         // Who the steps pay, in whichever step and of whatever token.
         // MSG_SENDER is the sender. The router itself, as ADDRESS_THIS or by
@@ -1475,14 +1353,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     v2PairFor(chainId, next.path[0], next.path[1]).toLowerCase()
             );
         };
-        // Whether a SWEEP, TRANSFER, PAY_PORTION or PAY_PORTION_FULL_PRECISION
-        // of `token` to `recipient` pays anyone WETH (see lastWethStep): it
-        // does when `token` is WETH, and when it pays ETH to a WETH contract,
-        // which pays the router WETH for it.
-        const paysWeth = (token, recipient) =>
-            WETH_ADDRESSES.includes(token.toLowerCase()) ||
-            (token === "0x0000000000000000000000000000000000000000" &&
-                WETH_ADDRESSES.includes(recipient.toLowerCase()));
 
         for (let i = 0; i < commandsBytes.length; i++) {
             const cmdId = commandsBytes[i] & commandTypeMask;
@@ -1499,9 +1369,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     ? COMMAND_NAMES[command]
                     : "Command 0x" + cmdId.toString(16).padStart(2, "0"),
             );
-            // Set by a branch below that reads a step that cannot take WETH
-            // out of the router or pay anyone WETH (see lastWethStep).
-            let keepsRouterWeth = false;
 
             try {
                 if (command === "EXECUTE_SUB_PLAN") {
@@ -1518,44 +1385,23 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 } else if (command === "PERMIT2_PERMIT") {
                     const p = decodePermit2(inputs[i]);
                     if (p) {
-                        permits.push({ ...p, step: i });
-                        keepsRouterWeth = true;
-                    } else {
-                        permitUnread(i);
-                    }
-                    // Only a permit whose amount stands as the Amount figure
-                    // names Token In (see permitStands). Every other permit,
-                    // before the step that sets the input side or after it,
-                    // leaves Token In and Amount as they read with no permit
-                    // and gets lines of its own. One after a step set the input
-                    // side never stands, so only one before it is kept here.
-                    if (p && !inputEstablished) {
                         // Whether a step before it took its token, or may
-                        // have: one in `userPaid`, `movedIntoRouter` or
-                        // `movedFromSender`, when its token is the permit's
-                        // or not known. No step has set the input side yet.
+                        // have: the step that set the input side or one in
+                        // `userPaid`, when its token is the permit's or not
+                        // known.
                         const mayBeItsToken = (token) =>
                             !present(token) || sameAddress(token, p.token);
-                        const tookBefore = [
-                            ...userPaid,
-                            ...movedIntoRouter,
-                            ...movedFromSender,
-                        ].some((t) => mayBeItsToken(t.token));
+                        const tookBefore =
+                            (inputEstablished && mayBeItsToken(inputToken)) ||
+                            userPaid.some((t) => mayBeItsToken(t.token));
                         permit = {
                             ...p,
                             step: i,
                             allowedToFail,
                             beforeEveryTake: !tookBefore,
                         };
-                    }
-                } else if (command === "PERMIT2_PERMIT_BATCH") {
-                    // Each allowance it grants gets the lines of a permit
-                    // whose amount does not stand. It pays nobody.
-                    const batch = decodePermit2Batch(inputs[i]);
-                    if (batch) {
-                        permits.push(...batch.map((p) => ({ ...p, step: i })));
                     } else {
-                        permitUnread(i);
+                        stepsUnread.push(i);
                     }
                 } else if (command === "PERMIT2_TRANSFER_FROM") {
                     const p = decodePermit2TransferFrom(inputs[i]);
@@ -1609,7 +1455,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         // what the user receives: it sets no side, and the
                         // step says so.
                         commandNames[i] += " (of another address)";
-                        keepsRouterWeth = true;
                     } else {
                         // The router passes this check whenever the owner
                         // holds at least minBalance, so a zero one guarantees
@@ -1620,23 +1465,21 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         // does. It pays nobody.
                         const minBalance = allowedToFail ? 0n : b.minBalance;
                         if (!(minBalance === 0n && present(minOutput))) {
-                            setOutput(i, b.token, minBalance, []);
+                            setOutput(b.token, minBalance);
                         }
-                        keepsRouterWeth = true;
                     }
                 } else if (command === "V3_SWAP_EXACT_IN") {
                     const s = decodeV3SwapExactIn(inputs[i]);
                     if (s) {
                         if (!inputEstablished) {
                             setInputOnce(s.tokenIn, s.amountIn);
-                            inputPaidByUser = s.payerIsUser;
                         } else if (s.payerIsUser) {
                             addUserPaid(s.tokenIn, s.amountIn);
                         }
                         // Always update output: in multi-step swaps (V3 → V4),
                         // the last swap step determines the final output token
                         // and minimum received amount.
-                        setOutput(i, s.tokenOut, s.amountOutMin, [s.recipient]);
+                        setOutput(s.tokenOut, s.amountOutMin);
                         if (!s.payerIsUser) {
                             spendFromRouter(s.tokenIn, s.amountIn);
                         }
@@ -1648,16 +1491,23 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         stepsUnread.push(i);
                         spentUnread();
                     }
+                } else if (command === "V3_SWAP_EXACT_OUT") {
+                    // This decoder does not read it
+                    // (https://git.eeqj.de/sneak/AutistMask/issues/601). It
+                    // may pay any address and take from the sender, so
+                    // wherever it stands it leaves no Amount figure.
+                    payeeUnread = true;
+                    stepsUnread.push(i);
+                    spentUnread();
                 } else if (command === "V2_SWAP_EXACT_IN") {
                     const s = decodeV2SwapExactIn(inputs[i]);
                     if (s) {
                         if (!inputEstablished) {
                             setInputOnce(s.tokenIn, s.amountIn);
-                            inputPaidByUser = s.payerIsUser;
                         } else if (s.payerIsUser) {
                             addUserPaid(s.tokenIn, s.amountIn);
                         }
-                        setOutput(i, s.tokenOut, s.amountOutMin, [s.recipient]);
+                        setOutput(s.tokenOut, s.amountOutMin);
                         if (!s.payerIsUser) {
                             spendFromRouter(s.tokenIn, s.amountIn);
                         }
@@ -1669,27 +1519,17 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         stepsUnread.push(i);
                         spentUnread();
                     }
-                } else if (
-                    command === "V2_SWAP_EXACT_OUT" ||
-                    command === "V3_SWAP_EXACT_OUT"
-                ) {
+                } else if (command === "V2_SWAP_EXACT_OUT") {
                     // Buys exactly amountOut and spends at most amountInMax.
-                    // Paid from the router, it spends an amount the calldata
-                    // does not state, so it spends nothing spendFromRouter()
-                    // could count.
-                    hasV2OrV3ExactOut = true;
-                    const s =
-                        command === "V2_SWAP_EXACT_OUT"
-                            ? decodeV2SwapExactOut(inputs[i])
-                            : decodeV3SwapExactOut(inputs[i]);
+                    hasV2ExactOut = true;
+                    const s = decodeV2SwapExactOut(inputs[i]);
                     if (s) {
                         if (!inputEstablished) {
                             setInputOnce(s.tokenIn, s.amountInMax);
-                            inputPaidByUser = s.payerIsUser;
                         } else if (s.payerIsUser) {
                             addUserPaid(s.tokenIn, s.amountInMax);
                         }
-                        setOutput(i, s.tokenOut, s.amountOut, [s.recipient]);
+                        setOutput(s.tokenOut, s.amountOut);
                         if (!isHop(i, s.tokenOut, s.recipient)) {
                             addPayee(s.recipient, s.tokenOut);
                         }
@@ -1711,7 +1551,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         if (!isRouter(s.recipient)) {
                             heldByRouter.delete(s.token.toLowerCase());
                         }
-                        keepsRouterWeth = !paysWeth(s.token, s.recipient);
                     } else {
                         payeeUnread = true;
                         stepsUnread.push(i);
@@ -1749,7 +1588,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         ) {
                             heldByRouter.delete(t.token.toLowerCase());
                         }
-                        keepsRouterWeth = !paysWeth(t.token, t.recipient);
                     } else {
                         payeeUnread = true;
                         stepsUnread.push(i);
@@ -1781,13 +1619,10 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 } else if (command === "WRAP_ETH") {
                     const w = decodeWrapEth(inputs[i]);
                     if (w) {
-                        if (!inputEstablished) {
-                            setInputOnce(
-                                "0x0000000000000000000000000000000000000000",
-                                w.amount,
-                            );
-                            inputPaidByUser = true;
-                        }
+                        setInputOnce(
+                            "0x0000000000000000000000000000000000000000",
+                            w.amount,
+                        );
                         addPayee(w.recipient);
                         // CONTRACT_BALANCE wraps all the router's ETH.
                         if (w.amount === CONTRACT_BALANCE) {
@@ -1852,14 +1687,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         (p) => p.currency === v4.tokenIn,
                     );
                     const amountIn = paidIn ? paidIn.amount : v4?.amountIn;
-                    // Where the step pays its output, if it sets the output
-                    // side (see outputRecipients).
-                    const takeRecipients = v4
-                        ? v4.takes
-                              .filter((t) => t.currency === v4.tokenOut)
-                              .map((t) => t.recipient)
-                              .concat(v4.recipientUnread ? [null] : [])
-                        : [];
                     if (v4 && v4.hasSwapAction) {
                         // A step with a swap action always sets the output
                         // side, as the last swap step wins, and sets the
@@ -1876,22 +1703,13 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         outputToken = v4.tokenOut;
                         minOutput = v4.amountOutMin;
                         outputEstablished = true;
-                        outputUnwrapped = false;
-                        unwrapIntoRouterStep = null;
-                        outputRecipients = takeRecipients;
-                        outputStep = i;
                     } else if (v4) {
                         // A step with no swap action sets only the sides its
                         // SETTLE, SETTLE_ALL, TAKE or TAKE_ALL names:
                         // setInputOnce() and setOutput() leave alone a side
                         // whose two halves are both unstated.
                         setInputOnce(v4.tokenIn, amountIn);
-                        setOutput(
-                            i,
-                            v4.tokenOut,
-                            v4.amountOutMin,
-                            takeRecipients,
-                        );
+                        setOutput(v4.tokenOut, v4.amountOutMin);
                     }
                     // Every V4 step, with a swap action or without, takes
                     // from the sender what the user pays it (an amount an
@@ -1901,7 +1719,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     // this decoder could not read may take anything: the
                     // router still runs it.
                     const setInputHere = inputEstablished && !inputSetBefore;
-                    if (setInputHere) inputPaidByUser = paidIn !== undefined;
                     if (v4) {
                         for (const p of v4.paidByUser) {
                             if (setInputHere && p === paidIn) continue;
@@ -1913,43 +1730,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     }
                 } else if (command === "UNWRAP_WETH") {
                     hasUnwrapWeth = true;
-                    // The router unwraps all the WETH it holds, even when the
-                    // recipient cannot be read. The output side's WETH is
-                    // among it when the step that set the output side paid it
-                    // to the router and the router still holds WETH. WETH
-                    // that step paid to the user, or to anyone else, stays
-                    // WETH. When that step also paid some of its output
-                    // elsewhere or made a payout this decoder did not read,
-                    // or this decoder treats a step between the two as one
-                    // that may take WETH out of the router or pay anyone WETH
-                    // (see lastWethStep), the WETH unwrapped may be only part
-                    // of the output side's, or none of it.
-                    // This decoder does not count how much of that step's
-                    // minimum then reaches the UNWRAP_WETH, nor read the
-                    // UNWRAP_WETH's own minimum, so the output side keeps no
-                    // figure.
                     const u = decodeUnwrapWeth(inputs[i]);
-                    const toRouter = (r) => present(r) && isRouter(r);
-                    if (
-                        present(outputToken) &&
-                        WETH_ADDRESSES.includes(outputToken.toLowerCase()) &&
-                        heldByRouter.has(outputToken.toLowerCase()) &&
-                        outputRecipients.some(toRouter)
-                    ) {
-                        outputUnwrapped = true;
-                        if (
-                            unwrapIntoRouterStep === null &&
-                            (u === null || isRouter(u.recipient))
-                        ) {
-                            unwrapIntoRouterStep = i;
-                        }
-                        if (
-                            !outputRecipients.every(toRouter) ||
-                            lastWethStep > outputStep
-                        ) {
-                            minOutput = null;
-                        }
-                    }
                     if (u) {
                         addPayee(u.recipient);
                         // It pays out all the router's WETH, as ETH. Into the
@@ -1971,8 +1752,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     }
                 } else {
                     // Any other step may pay an address this decoder does not
-                    // read: the NFT commands among them, and a type the
-                    // release names no command for.
+                    // read: PERMIT2_PERMIT_BATCH and the NFT commands among
+                    // them, and a type the release names no command for.
                     payeeUnread = true;
                     stepsUnread.push(i);
                 }
@@ -1986,26 +1767,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (allowedToFail) {
                 commandNames[i] += " (allowed to fail)";
             }
-            if (!keepsRouterWeth) {
-                lastWethStep = i;
-            }
-        }
-
-        // After an UNWRAP_WETH that may have paid the output side's WETH to
-        // the router as ETH, a later step may pay that ETH out as WETH, as a
-        // WRAP_ETH of it to the user does. This decoder treats every later
-        // step but those lastWethStep names as one that may, and does not
-        // count how much of that ETH each pays out: after one, the output
-        // side reads as WETH with no figure. Neither this nor the loss of the
-        // figure in the UNWRAP_WETH branch is undone by any later step, a
-        // later UNWRAP_WETH included, but one that sets the output side again.
-        if (
-            outputUnwrapped &&
-            unwrapIntoRouterStep !== null &&
-            lastWethStep > unwrapIntoRouterStep
-        ) {
-            outputUnwrapped = false;
-            minOutput = null;
         }
 
         // The Amount line, and the lines for what the steps take beyond it.
@@ -2018,26 +1779,18 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // lines of its own. One whose amount is not known also leaves the
         // total unknown, with no figure.
         //
-        // A PERMIT2_PERMIT names Token In only when its amount stands as the
-        // Amount figure in place of the total, which it does only in the
-        // plain shape of Uniswap's own routes: it comes before the step that
-        // set the input side, it is the only PERMIT2_PERMIT in the
-        // transaction and there is no PERMIT2_PERMIT_BATCH, its spender is
+        // The last PERMIT2_PERMIT read names Token In. Its amount stands as
+        // the Amount figure in place of the total only in the plain shape of
+        // Uniswap's own routes: it is the only PERMIT2_PERMIT, its spender is
         // the router, the router may not let it fail, no step before it took
-        // its token or one not known (a PERMIT2_TRANSFER_FROM of its token
-        // included), and this decoder read every step after it in full (see
-        // stepsUnread). Permit2 then lets the router take no more of the token
-        // than that amount, so the permit covers every take of it. A step
-        // before it takes under whatever allowance the router already had, so
-        // it may take more. A later permit or batch, or a later step this
-        // decoder did not read, may raise what Permit2 lets the router take.
-        // Every other PERMIT2_PERMIT leaves Token In and the Amount line as
-        // they read with no permit, and gets lines of its own below. A step
-        // that may take from the sender what this decoder did not read leaves
-        // no figure, permit or not (see spentUnread()), and so do a permit
-        // or batch whose input it cannot read (see permitUnread()) and an
-        // allowance of Token In to another spender (see toAnotherSpender). An
-        // EXECUTE_SUB_PLAN step leaves both sides unknown (below).
+        // its token or one not known, and this decoder read every step after
+        // it in full (see stepsUnread). Permit2 then lets the router take no
+        // more of the token than that amount, so the permit covers every take
+        // of it. A later step this decoder did not read may raise what Permit2
+        // lets the router take, as a PERMIT2_PERMIT_BATCH can. A step that
+        // may take from the sender what this decoder did not read leaves no
+        // figure, permit or not (see spentUnread()), and an EXECUTE_SUB_PLAN
+        // step leaves both sides unknown (below).
         const stepCommands = Array.from(
             commandsBytes,
             (b) => commands[b & commandTypeMask],
@@ -2045,7 +1798,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         const permitStands =
             permit !== null &&
             stepCommands.filter((c) => c === "PERMIT2_PERMIT").length === 1 &&
-            !stepCommands.includes("PERMIT2_PERMIT_BATCH") &&
             sameAddress(permit.spender, toAddress) &&
             !permit.allowedToFail &&
             permit.beforeEveryTake &&
@@ -2055,35 +1807,20 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // (see spentUnread()), or a token it does not know.
         const spentFromSender = [];
         let total = null;
-        // The takes from the sender that `total` adds up, each a quantity, as
-        // { token, amount }. When there is no Amount line, each gets lines of
-        // its own (see below). The amount of a step that set the input side
-        // and is paid from the router counts in `total` but is not among them.
-        const inTotal = [];
-        // Whether the step that set the input side counts as a take from the
-        // sender, which may get lines of its own. The amount it stated counts
-        // whoever pays it. Stating none, it counts only when the user pays it
-        // some of its input token: paid from the router, it takes nothing
-        // from the sender.
-        const hasFirstTake =
-            inputEstablished && (present(inputAmount) || inputPaidByUser);
         // The take of the step that set the input side, when the total
         // starts from it and it stated no amount (see below), or null.
         let firstTakeUnstated = null;
-        if (!permitStands || sameAddress(inputToken, permit.token)) {
+        if (permit === null || sameAddress(inputToken, permit.token)) {
             total = inputAmount;
-            if (typeof inputAmount === "bigint" && inputPaidByUser) {
-                inTotal.push({ token: inputToken, amount: inputAmount });
-            }
-            if (hasFirstTake && !present(inputAmount)) {
+            if (inputEstablished && !present(inputAmount)) {
                 firstTakeUnstated = { token: inputToken, amount: null };
             }
-        } else if (hasFirstTake) {
+        } else if (inputEstablished) {
             // The step that set the input side spent a token other than the
-            // permit's, or one not known, so its amount gets lines of its own.
+            // permit's, or one not known, so the total starts with no figure.
             spentFromSender.push({ token: inputToken, amount: inputAmount });
         }
-        if (permitStands) inputToken = permit.token;
+        if (permit !== null) inputToken = permit.token;
         for (const t of userPaid) {
             const ofTokenIn = sameAddress(t.token, inputToken);
             if (ofTokenIn && permitStands) continue;
@@ -2093,55 +1830,52 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 typeof t.amount === "bigint"
             ) {
                 total += t.amount;
-                inTotal.push(t);
                 continue;
             }
             spentFromSender.push(t);
             if (ofTokenIn && !present(t.amount)) total = null;
         }
         inputAmount = permitStands ? permit.amount : total;
-        // With no Amount figure, a later take's own figure, or that of a
-        // PERMIT2_TRANSFER_FROM of the same token, into the router or not,
-        // could read as all that leaves, so the step that set the input side,
-        // when the user pays it and it stated no amount, then gets lines of
-        // its own too, first, saying its amount is not known.
+        // With no Amount figure, a later take's own figure could read as all
+        // that leaves, so the step that set the input side, when it stated
+        // no amount, then gets lines of its own too, first, saying its amount
+        // is not known.
         if (
             !present(inputAmount) &&
             firstTakeUnstated !== null &&
-            (spentFromSender.some((s) => present(s.amount)) ||
-                [...movedFromSender, ...movedIntoRouter].some((m) =>
-                    sameAddress(m.token, firstTakeUnstated.token),
-                ))
+            spentFromSender.some((s) => present(s.amount))
         ) {
             spentFromSender.unshift(firstTakeUnstated);
         }
 
         // The commands of an EXECUTE_SUB_PLAN step may spend the user's tokens
-        // or pay the user, before or after any other step. What the other
-        // steps state is then not the whole swap, so both sides are set
-        // unknown, with no figure, wherever the step stands.
+        // or pay the user, before or after any other step, and a permit among
+        // them would name Token In. What the other steps state is
+        // then not the whole swap, so both sides are set unknown, with no
+        // figure, wherever the step stands.
         if (hasSubPlan) {
             inputToken = null;
             inputAmount = null;
             outputToken = null;
             minOutput = null;
             outputEstablished = true;
-            outputUnwrapped = false;
         }
 
         // Resolve token info. A null token on either side means no step named
         // a currency for it, a V4 step with a swap action left it unknown, or
         // an EXECUTE_SUB_PLAN step did; tokenInfo() refuses rather than calling
         // it ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
-        // when it unwraps the output side's WETH (`outputUnwrapped`), or when
-        // no step set the output side. A V4 step with a swap action, or
-        // an EXECUTE_SUB_PLAN step, did set it, even when it set it unknown.
-        // Any other output keeps its own token and figure: a swap that pays
-        // its WETH to the user and then unwraps receives WETH, and one that
-        // buys USDC and then unwraps the WETH it did not spend receives USDC.
+        // when the output side is WETH, or when no step set the output side. A
+        // V4 step with a swap action, or an EXECUTE_SUB_PLAN step, did set it,
+        // even when it set it unknown. Any other output keeps its own token
+        // and figure: a swap that buys USDC and then unwraps the WETH it did
+        // not spend receives USDC.
+        const outputIsWeth =
+            present(outputToken) &&
+            WETH_ADDRESSES.includes(outputToken.toLowerCase());
         const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
-            outputUnwrapped || (hasUnwrapWeth && !outputEstablished)
+            hasUnwrapWeth && (outputIsWeth || !outputEstablished)
                 ? { symbol: "ETH", decimals: 18, address: null }
                 : tokenInfo(outputToken, sources);
 
@@ -2207,12 +1941,12 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (amount >= MAX_UINT160) {
                 return { raw: "Unlimited", display: "Unlimited" };
             }
-            if (hasV2OrV3ExactOut) {
-                // A V2 or V3 exact-out swap spends at most this figure,
-                // whichever steps gave it (an amountInMax, the WRAP_ETH of a
-                // swap paid in ETH, a permit, or several steps' total), so it
-                // is said to be a maximum, in `raw` too: the wait, success and
-                // error screens show `raw` as the transaction's amount.
+            if (hasV2ExactOut) {
+                // A V2 exact-out swap spends at most this figure, whichever
+                // steps gave it (an amountInMax, the WRAP_ETH of a swap paid
+                // in ETH, a permit, or several steps' total), so it is said to
+                // be a maximum, in `raw` too: the wait, success and error
+                // screens show `raw` as the transaction's amount.
                 const most = amountText(amount, info);
                 return {
                     raw: "Up to " + most.raw,
@@ -2222,30 +1956,12 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             return amountText(amount, info);
         };
 
-        // Each allowance to a spender other than the router. Code that a step
-        // runs, such as a V4 pool's hook or a token's own code, can call that
-        // spender, which can then take up to the allowance from the sender
-        // before the transaction ends. A permit or batch this decoder could
-        // not read may be to any spender, of any token.
-        const toAnotherSpender = permits.filter(
-            (p) => !sameAddress(p.spender, toAddress),
-        );
-
         // A null token in `spentFromSender`, a step this decoder did not read
-        // or a token it does not know, and an allowance to another spender
-        // that may be of Token In, leave no Amount figure, which may then be
-        // too low. With no Amount line, each take the total adds up gets
-        // lines of its own, first, so that every amount this decoder read is
-        // shown.
+        // or a token it does not know, leaves no Amount figure, which may
+        // then be too low.
         if (
             present(inputAmount) &&
-            spentFromSender.every((s) => present(s.token)) &&
-            toAnotherSpender.every(
-                (p) =>
-                    present(p.token) &&
-                    present(inputToken) &&
-                    !sameAddress(p.token, inputToken),
-            )
+            spentFromSender.every((s) => present(s.token))
         ) {
             const amount = spentText(inputAmount, inInfo);
             details.push({
@@ -2253,8 +1969,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 value: amount.display,
                 rawValue: amount.raw,
             });
-        } else {
-            spentFromSender.unshift(...inTotal);
         }
 
         // What steps take from the sender beyond the Amount line, in the shape
@@ -2297,40 +2011,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             );
         }
 
-        // What each allowance of a PERMIT2_PERMIT or PERMIT2_PERMIT_BATCH lets
-        // its spender take: its amount, its token and the spender, an address
-        // on a line of its own. Permit2's maximum is unbounded. Only a permit
-        // whose amount stands as the Amount figure (see permitStands) gets
-        // none: that line already gives its amount and Token In its token,
-        // and its spender is the router. Every other allowance, one after the
-        // step that set the input side included, gets these lines, so nothing
-        // it lets anyone take goes unstated. A permit or batch this decoder
-        // could not read gets one line saying so.
-        for (const p of permits) {
-            if (permitStands && p.step === permit.step) continue;
-            if (!present(p.token)) {
-                details.push({
-                    label: "Permit2 allowance",
-                    value: UNDECODED_CURRENCY,
-                });
-                continue;
-            }
-            details.push({
-                label: "Permit2 allowance",
-                value:
-                    p.amount >= MAX_UINT160
-                        ? "Unlimited"
-                        : amountText(p.amount, tokenInfo(p.token, sources))
-                              .display,
-            });
-            details.push(tokenMovedLine("Allowance token", p.token, sources));
-            details.push({
-                label: "Allowance spender",
-                value: p.spender,
-                address: p.spender,
-            });
-        }
-
         // Keyed on the address, not the symbol: a token absent from the
         // bundled list has no symbol, and gating the line on one dropped it
         // entirely, leaving a Min. received figure with nothing saying what is
@@ -2366,10 +2046,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // step pays the bridge, when one moves the sender's tokens into the
         // router, when a token stays in the router, and when a payout could
         // not be read. The output is received by the sender only when some
-        // step pays the sender, there is no such line, and no allowance goes
-        // to another spender (see toAnotherSpender). When no step names anyone
-        // paid, one line says so. `paidTo` holds these lines and the token
-        // line after each line about a token in the router.
+        // step pays the sender and there is no such line. When no step names
+        // anyone paid, one line says so. `paidTo` holds these lines and the
+        // token line after each line about a token in the router.
         const outputHeld =
             present(outputToken) && heldByRouter.has(outputToken.toLowerCase());
         const paidTo = paidElsewhere.map((address) => ({
@@ -2416,10 +2095,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         if (payeeUnread) {
             paidTo.push({ label: "Paid to", value: UNDECODED_CURRENCY });
         }
-        const received =
-            paidToSender &&
-            paidTo.length === 0 &&
-            toAnotherSpender.length === 0;
+        const received = paidToSender && paidTo.length === 0;
         if (!paidToSender && paidTo.length === 0) {
             paidTo.push({ label: "Paid to", value: UNNAMED_CURRENCY });
         }
@@ -2464,4 +2140,4 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
     }
 }
 
-module.exports = { decode, routerRelease };
+module.exports = { decode };

tests/approvalTokenNetwork.test.js

@@ -1,16 +1,11 @@
 // The approval screen for a site's Sepolia token transfer while Ethereum
-// Mainnet is active.
+// Mainnet is active (https://git.eeqj.de/sneak/AutistMask/issues/629).
 //
 // The screen named the token, and scaled its amount, from the active network's
 // tracked tokens and balances, so a token the wallet tracks on Sepolia read as
 // an unknown token with its amount in base units, and the screens after it
-// labelled the amount `?` (https://git.eeqj.de/sneak/AutistMask/issues/629).
-// It now uses what the wallet knows of the tokens on the network the
-// transaction is for.
-//
-// Its address links opened the active network's explorer
-// (https://git.eeqj.de/sneak/AutistMask/issues/631). They now open the
-// explorer of the network the transaction is for.
+// labelled the amount `?`. It now uses what the wallet knows of the tokens on
+// the network the transaction is for.
 //
 // Driven through the real approval screen, password and Confirm included,
 // against a minimal DOM stub in the shape tests/swapStatusAmount.test.js uses.
@@ -112,13 +107,10 @@ function decodedLine(label) {
 }
 
 // Open the approval screen, with Ethereum Mainnet active and FROM holding
-// `tokenBalances` there, for the site's transaction sending TRANSFER_DATA to
-// the token, on Sepolia unless `chainId` names another chain. Confirm answers
-// the signed transaction with a failure, which leads to the error screen.
-async function showTokenTransfer(
-    tokenBalances = [],
-    chainId = NETWORKS.sepolia.chainId,
-) {
+// `tokenBalances` there, for the site's Sepolia transaction sending
+// TRANSFER_DATA to the token. Confirm answers the signed transaction with a
+// failure, which leads to the error screen.
+async function showSepoliaTransfer(tokenBalances = []) {
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" }, close: () => {} };
     globalThis.chrome.runtime = {
@@ -139,7 +131,7 @@ async function showTokenTransfer(
                 approvedTx: {
                     type: 2,
                     from: FROM,
-                    chainId,
+                    chainId: NETWORKS.sepolia.chainId,
                     nonce: "0x7",
                     gasLimit: "0x30d40",
                     maxPriorityFeePerGas: "0x3b9aca00",
@@ -191,7 +183,7 @@ describe("a token tracked on Sepolia only", () => {
     });
 
     test("is named on the Contract line and the decoded Token line, with its amount at its scale", async () => {
-        await showTokenTransfer();
+        await showSepoliaTransfer();
         expect(node("approve-tx-to").innerHTML).toContain(
             '<div class="font-bold mb-1">TDOL</div>',
         );
@@ -204,7 +196,7 @@ describe("a token tracked on Sepolia only", () => {
     });
 
     test("labels the amount on the error screen that follows", async () => {
-        await showTokenTransfer();
+        await showSepoliaTransfer();
         await confirm();
         expect(state.currentView).toBe("error-tx");
         expect(node("error-tx-summary").textContent).toBe("1234.5000 TDOL");
@@ -215,7 +207,7 @@ describe("a token tracked on Sepolia only", () => {
 // tracks and holds there names nothing on Sepolia.
 test("a token tracked and held on mainnet only is not named, and its amount is in base units", async () => {
     state.trackedTokens = [{ address: TOKEN, symbol: "MDOL", decimals: 18 }];
-    await showTokenTransfer([
+    await showSepoliaTransfer([
         { address: TOKEN, symbol: "MDOL", decimals: 18, balance: "1.0" },
     ]);
     expect(node("approve-tx-to").innerHTML).not.toContain("MDOL");
@@ -226,45 +218,3 @@ test("a token tracked and held on mainnet only is not named, and its amount is i
         '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
     );
 });
-
-// The From and Contract lines, and the decoded Token and Recipient lines.
-test("every address links to the Sepolia explorer", async () => {
-    await showTokenTransfer();
-    const sepolia = NETWORKS.sepolia.explorerUrl;
-    expect(node("approve-tx-from").innerHTML).toContain(
-        `href="${sepolia}/address/${FROM}"`,
-    );
-    expect(node("approve-tx-to").innerHTML).toContain(
-        `href="${sepolia}/address/${TOKEN}"`,
-    );
-    expect(decodedLine("Token")).toContain(
-        `href="${sepolia}/address/${TOKEN}"`,
-    );
-    expect(decodedLine("Recipient")).toContain(
-        `href="${sepolia}/address/${RECIPIENT}"`,
-    );
-    for (const id of [
-        "approve-tx-from",
-        "approve-tx-to",
-        "approve-tx-decoded-details",
-    ]) {
-        expect(node(id).innerHTML).not.toContain(NETWORKS.mainnet.explorerUrl);
-    }
-});
-
-// Chain id 1337 names no network here, so it has no explorer to link to.
-test("a transaction on a chain id that names no network is shown with no address links", async () => {
-    await showTokenTransfer([], "0x539");
-    expect(state.currentView).toBe("approve-tx");
-    expect(node("approve-tx-network").textContent).toBe(
-        "Unknown network (chain id 1337)",
-    );
-    expect(node("approve-tx-from").innerHTML).toContain(FROM);
-    for (const id of [
-        "approve-tx-from",
-        "approve-tx-to",
-        "approve-tx-decoded-details",
-    ]) {
-        expect(node(id).innerHTML).not.toContain("href=");
-    }
-});

tests/approvalValueUsd.test.js

@@ -1,192 +0,0 @@
-// The USD value on the approval screen's Value and Network fee lines, for a
-// site's ETH send.
-//
-// It was worked out from the four-decimal figure the line shows, at the price
-// on the active network, so the same value read a few cents different here than
-// on the confirmation screen, which prices the exact amount at the price on the
-// transaction's own network, and a transaction on another network than the
-// active one was priced at the active one's rate, its fee too
-// (https://git.eeqj.de/sneak/AutistMask/issues/614).
-//
-// Driven through the real approval screen, against a minimal DOM stub in the
-// shape tests/approvalTokenNetwork.test.js uses.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { state } = require("../src/shared/state");
-const { NETWORKS } = require("../src/shared/networks");
-const { prices, clearPrices } = require("../src/shared/prices");
-const approval = require("../src/popup/views/approval");
-
-const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-
-function makeElement(id) {
-    const classes = new Set();
-    const el = {
-        id,
-        textContent: "",
-        value: "",
-        innerHTML: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        listeners: {},
-        classList: {
-            add: (...names) => names.forEach((n) => classes.add(n)),
-            remove: (...names) => names.forEach((n) => classes.delete(n)),
-            contains: (n) => classes.has(n),
-            toggle: (n, force) => {
-                const on = force === undefined ? !classes.has(n) : force;
-                if (on) classes.add(n);
-                else classes.delete(n);
-                return on;
-            },
-        },
-        addEventListener: (name, fn) => {
-            el.listeners[name] = el.listeners[name] || [];
-            el.listeners[name].push(fn);
-        },
-        querySelectorAll: () => [],
-        appendChild: () => {},
-    };
-    // Views reach for .parentElement to hide whole sections.
-    Object.defineProperty(el, "parentElement", {
-        get: () => node(id + "-parent"),
-    });
-    return el;
-}
-
-function makeDocument() {
-    const els = new Map();
-    return {
-        getElementById(id) {
-            // The debug banner is created on demand by helpers.js; absent
-            // is the state a non-debug, non-testnet popup is in.
-            if (id === "debug-banner") return null;
-            if (!els.has(id)) els.set(id, makeElement(id));
-            return els.get(id);
-        },
-        createElement: () => makeElement("created"),
-        body: { prepend: () => {} },
-    };
-}
-
-function node(id) {
-    return globalThis.document.getElementById(id);
-}
-
-// Open the approval screen, with the network `networkId` active, for the
-// site's transaction sending 1.23414 ETH to RECIPIENT on the chain `chainId`.
-async function showEthSend(chainId, networkId) {
-    globalThis.document = makeDocument();
-    globalThis.window = { location: { search: "" }, close: () => {} };
-    globalThis.chrome.runtime = {
-        connect: () => ({ postMessage: () => {} }),
-        sendMessage: (msg, reply) => {
-            if (!reply) return;
-            reply({
-                type: "tx",
-                origin: "https://dapp.example",
-                isPhishingDomain: false,
-                approvedFrom: FROM,
-                approvedTx: {
-                    type: 2,
-                    from: FROM,
-                    chainId,
-                    nonce: "0x7",
-                    gasLimit: "0x5208",
-                    maxPriorityFeePerGas: "0x3b9aca00",
-                    maxFeePerGas: "0x77359400",
-                    to: RECIPIENT,
-                    value: "1234140000000000000",
-                    data: "0x",
-                    accessList: [],
-                },
-            });
-        },
-    };
-    state.networkId = networkId;
-    state.activeAddress = FROM;
-    state.wallets = [
-        {
-            type: "hd",
-            name: "Wallet 1",
-            xpub: "xpub-wallet-1",
-            encryptedSecret: "encrypted-secret-1",
-            nextIndex: 1,
-            addresses: [{ address: FROM, index: 0, balance: "0" }],
-        },
-    ];
-    state.trackedTokens = [];
-    state.networkTrackedTokens = {};
-    state.currentView = null;
-    approval.init({});
-    await approval.show(1);
-}
-
-beforeEach(() => {
-    prices.ETH = 2000;
-});
-
-afterEach(() => {
-    clearPrices();
-});
-
-// 1.23414 ETH reads 1.2341 ETH. At $2,000 the exact value is $2,468.28, the
-// figure the confirmation screen shows for it; the shown figure would be
-// $2,468.20.
-test.each([
-    [
-        "a mainnet transaction is priced from its exact value",
-        NETWORKS.mainnet.chainId,
-        "mainnet",
-        "1.2341 ETH ($2,468.28)",
-    ],
-    [
-        "a mainnet transaction shown with Sepolia active is priced at the mainnet price",
-        NETWORKS.mainnet.chainId,
-        "sepolia",
-        "1.2341 ETH ($2,468.28)",
-    ],
-    [
-        "a Sepolia transaction shown with mainnet active has no USD value",
-        NETWORKS.sepolia.chainId,
-        "mainnet",
-        "1.2341 SepoliaETH",
-    ],
-    // Chain id 1337 names no network here, so nothing knows its price.
-    [
-        "a transaction on a chain id that names no network has no USD value",
-        "0x539",
-        "mainnet",
-        "1.2341 ETH",
-    ],
-])("%s", async (_label, chainId, networkId, expected) => {
-    await showEthSend(chainId, networkId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(node("approve-tx-value").textContent).toBe(expected);
-});
-
-// The Network fee line is priced on the transaction's network too. 21000 gas at
-// up to 2 gwei is 0.000042 ETH, $0.08 at $2,000.
-test.each([
-    [
-        "the fee of a mainnet transaction shown with Sepolia active is priced at the mainnet price",
-        NETWORKS.mainnet.chainId,
-        "sepolia",
-        "0.00004 ETH ($0.08)",
-    ],
-    [
-        "the fee of a Sepolia transaction shown with mainnet active has no USD value",
-        NETWORKS.sepolia.chainId,
-        "mainnet",
-        "0.00004 SepoliaETH",
-    ],
-])("%s", async (_label, chainId, networkId, expected) => {
-    await showEthSend(chainId, networkId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(node("approve-tx-fee").textContent).toBe(expected);
-});

tests/backgroundStateIsolation.test.js

@@ -19,10 +19,7 @@
 //     that followed persisted the pre-refresh values — while still stamping
 //     lastBalanceRefresh, suppressing the redo.
 //
-// A network switch landing inside a balance refresh's round trip is covered at
-// the end (https://git.eeqj.de/sneak/AutistMask/issues/577).
-//
-// All use the real persistence path over a cloning storage stub. Nothing here
+// Both use the real persistence path over a cloning storage stub. Nothing here
 // asserts the absence of a loadState() call; each asserts the OUTCOME, so it
 // holds against any implementation that gets the outcome right.
 
@@ -398,48 +395,3 @@ describe("a balance refresh under another handler's state read", () => {
         expect(after.wallets[0].addresses[0].balance).toBe(REFRESHED_BALANCE);
     });
 });
-
-describe("a balance refresh under a network switch", () => {
-    // https://git.eeqj.de/sneak/AutistMask/issues/577. The switch clears every
-    // address's balances, and a refresh that started on the previous network
-    // must not write that network's back over them when it returns. The same
-    // refresh in the popup is in tests/balanceRefreshNetworkSwitch.test.js.
-    test("a refresh that returns after a switch writes nothing, and the next one runs on the new network", async () => {
-        const roundTrip = deferred();
-        const reachedNetwork = deferred();
-        const ranOn = [];
-
-        const bg = loadWorker("sepolia", {
-            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
-                ranOn.push(id);
-                reachedNetwork.resolve();
-                await roundTrip.promise;
-                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
-            },
-        });
-
-        const refresh = bg.fireBalanceAlarm();
-        await reachedNetwork.promise;
-
-        // The user switches to Ethereum Mainnet in Settings while the round
-        // trip is out.
-        const during = bg.persisted();
-        applyChainSwitchFields(during, MAINNET.id);
-        global.chrome.storage.write("autistmask", during);
-
-        roundTrip.resolve();
-        await refresh;
-
-        const after = bg.persisted();
-        expect(after.networkId).toBe("mainnet");
-        expect(after.wallets[0].addresses[0].balance).toBe("0");
-        expect(after.lastBalanceRefresh).toBe(0);
-
-        await bg.fireBalanceAlarm();
-
-        expect(ranOn).toEqual(["sepolia", "mainnet"]);
-        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
-            REFRESHED_BALANCE,
-        );
-    });
-});

tests/balanceRefreshCancelled.test.js

@@ -18,11 +18,6 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
-const TRACKED = {
-    address: "0x7777777777777777777777777777777777777777",
-    symbol: "TRK",
-    decimals: 6,
-};
 
 const realFetch = globalThis.fetch;
 let logged;
@@ -35,9 +30,9 @@ beforeEach(() => {
     const failedToFetch = async () => {
         throw new TypeError("Failed to fetch");
     };
-    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
-    // the scan's balance and transaction count) and the explorer request (the
-    // other token balances) all fail the same way.
+    // The RPC calls (ETH balance, ENS name, and the scan's balance and
+    // transaction count) and the explorer request (token balances) all fail
+    // the same way.
     FetchRequest.registerGetUrl(failedToFetch);
     globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -54,7 +49,7 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
-        [TRACKED],
+        [],
         "mainnet",
         signal,
     );
@@ -65,7 +60,6 @@ test("a failure while the popup is open is reported", async () => {
     for (const label of [
         "ETH balance failed",
         "ENS reverse failed",
-        "token balance failed",
         "fetchTokenBalances failed: Failed to fetch",
     ]) {
         expect(logged.some((line) => line.includes(label))).toBe(true);

tests/balanceRefreshNetworkSwitch.test.js

@@ -1,161 +0,0 @@
-// A balance refresh the popup started on one network, and that returns after
-// the network was switched to another, writes nothing: the switch cleared every
-// address's balances, and the previous network's must not come back over them
-// (https://git.eeqj.de/sneak/AutistMask/issues/577). The switch is made either
-// by the user in this popup's Settings, or by the background after the user
-// approved a site's request, which changes only the stored record. Driven
-// through the real popup over a stored profile on Ethereum Mainnet. The same
-// refresh in the background is in tests/backgroundStateIsolation.test.js.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-    TOKEN_ADDRESS,
-} = require("./support/popupBoot");
-const { applyChainSwitchFields } = require("../src/shared/chainSwitchFields");
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// Starts the ten-second refresh and holds it open. The balance stand-in writes
-// Ethereum Mainnet's balances in place, on the records handed in, as the real
-// refreshBalances() does, once the returned function is called. Resolves with
-// that function and the refresh still running.
-async function holdRefresh(page) {
-    const { refreshBalances } = require("../src/shared/balances");
-    let answer;
-    refreshBalances.mockImplementationOnce(async (wallets) => {
-        await new Promise((resolve) => {
-            answer = resolve;
-        });
-        wallets[0].addresses[0].balance = "7.0";
-        wallets[0].addresses[0].tokenBalances = [
-            {
-                address: TOKEN_ADDRESS,
-                name: "Test Token",
-                symbol: "TST",
-                decimals: 18,
-                balance: "5.0",
-                holders: null,
-            },
-        ];
-    });
-    const ticking = page.tick();
-    await page.settle();
-    return {
-        finish: async () => {
-            answer();
-            await ticking;
-        },
-    };
-}
-
-// Picks `networkId` in the Settings network selector, as the user does.
-async function chooseNetwork(page, networkId) {
-    const select = page.node("settings-network");
-    select.value = networkId;
-    for (const fn of select.listeners.change) await fn();
-    await page.settle();
-}
-
-// The stored record holds none of Ethereum Mainnet's balances, and no refresh
-// recorded as done.
-function expectNothingStored(page) {
-    const stored = page.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.wallets[0].addresses[0].balance).toBe("0");
-    expect(stored.wallets[0].addresses[0].tokenBalances).toEqual([]);
-    expect(stored.lastBalanceRefresh).toBe(0);
-}
-
-test("a refresh that returns after a switch in Settings writes nothing, and the next one runs on the new network", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.pageErrors).toEqual([]);
-    const { refreshBalances } = require("../src/shared/balances");
-    const { state } = require("../src/shared/state");
-
-    const refresh = await holdRefresh(page);
-    await page.click("btn-settings");
-    await chooseNetwork(page, "sepolia");
-    await refresh.finish();
-
-    expect(state.wallets[0].addresses[0].balance).toBe("0");
-    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
-    expectNothingStored(page);
-
-    await page.click("btn-settings-back");
-    expect(page.visibleViews()).toEqual(["main"]);
-    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
-
-    await page.tick();
-
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
-    expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
-        0,
-    );
-});
-
-// The switch is made only once the refresh's save, holding the lock, has
-// written Ethereum Mainnet's balances, and the switch then clears them.
-test("a refresh whose save is reading the stored record when the user switches in Settings leaves none of its balances stored", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.pageErrors).toEqual([]);
-    const { state } = require("../src/shared/state");
-
-    const refresh = await holdRefresh(page);
-    await page.click("btn-settings");
-
-    // The next read of the stored record, the refresh's save's, is held.
-    const get = page.storage.local.get;
-    const read = get.getMockImplementation();
-    let releaseRead;
-    get.mockImplementationOnce(async (key) => {
-        await new Promise((resolve) => {
-            releaseRead = resolve;
-        });
-        return read(key);
-    });
-    const finishing = refresh.finish();
-    await page.settle();
-
-    // The user picks Sepolia meanwhile; the switch's own save waits for the
-    // refresh's save to let the lock go.
-    const select = page.node("settings-network");
-    select.value = "sepolia";
-    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
-    await page.settle();
-
-    releaseRead();
-    await finishing;
-    await switching;
-    await page.settle();
-
-    expect(state.networkId).toBe("sepolia");
-    expect(state.wallets[0].addresses[0].balance).toBe("0");
-    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
-    expectNothingStored(page);
-});
-
-test("a refresh that returns after the background switched the network writes nothing", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.pageErrors).toEqual([]);
-    const { saveState } = require("../src/shared/state");
-
-    const refresh = await holdRefresh(page);
-    // The background writes the switch to Sepolia, as its updateState() does
-    // once the user approves a site's request. This page is not told of it
-    // yet.
-    const record = page.storage.read("autistmask");
-    applyChainSwitchFields(record, "sepolia");
-    page.storage.write("autistmask", record);
-    await refresh.finish();
-
-    expectNothingStored(page);
-
-    // Nor does a later save by this page, such as every navigation makes.
-    await saveState();
-
-    expectNothingStored(page);
-});

tests/chainSwitchGate.test.js

@@ -446,10 +446,7 @@ describe("switching the network in Settings tells every open tab", () => {
         global.chrome.runtime.sendMessage = (msg) => {
             bg.send(msg, POPUP);
         };
-        const { state, loadState } = require("../src/shared/state");
-        await loadState();
-        // Set by showView(), which is mocked above.
-        state.currentView = "settings";
+        await require("../src/shared/state").loadState();
         require("../src/popup/views/settings").init({
             pageClosed: new AbortController().signal,
         });

tests/confirmTxAmount.test.js

@@ -158,7 +158,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const {
     Interface,

tests/confirmTxNetworkSwitch.test.js

@@ -189,7 +189,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const {
     BaseWallet,

tests/dustThreshold.test.js

@@ -101,7 +101,7 @@ describe("the flash line the message is shown in", () => {
     //
     // The line cuts a message too long for it with an ellipsis (see
     // showFlash() in src/popup/views/helpers.js). The assertions that
-    // measure that, in a real browser at the documented 396x600 popup, are
+    // measure that, in a real browser at the documented 360x600 popup, are
     // "a rejected dust threshold shifts no layout (#233)" and "an over-long
     // flash message keeps to one line (#252)" in tests/e2e/run.js, run by
     // make test-e2e. They are not in make check because REPO_POLICIES.md

tests/e2e/firefox/run.js

@@ -867,14 +867,6 @@ step(
             "the page was not told of the approved switch: " +
                 JSON.stringify(events),
         );
-        // The popup, open all along, shows the new network
-        // (https://git.eeqj.de/sneak/AutistMask/issues/650).
-        await d.switchToWindow(env.popupWindow);
-        await d.waitFor(
-            "the open popup to show the testnet banner",
-            `const banner = document.getElementById("debug-banner");
-             return banner !== null && banner.textContent === "[TESTNET]";`,
-        );
 
         await openNetworkPrompt(env, "switch-restore", sepolia, mainnet);
         await d.click("#btn-approve-network");
@@ -889,10 +881,6 @@ step(
             isDeepStrictEqual(await storedNetwork(env), before),
             "switching back did not restore the mainnet network and endpoints",
         );
-        await d.waitFor(
-            "the open popup to drop the testnet banner",
-            `return document.getElementById("debug-banner") === null;`,
-        );
         await d.switchToWindow(env.dappWindow);
     },
 );

tests/e2e/run.js

@@ -60,14 +60,6 @@ const TEST_TIMEOUT_MS = 120000;
 // trailing drain in main().
 const TRAILING_WATCH_MS = 1500;
 
-// The popup's size, as README gives it: `body` in src/popup/styles/main.css
-// is 396px wide, and src/background/index.js opens an approval window at
-// the same 396x600. Pages in this context otherwise get Playwright's
-// 1280x720 default, where the page never scrolls sideways and a button
-// below the popup's fold is still on screen, so a layout measured there
-// passes whatever the page does.
-const POPUP_VIEWPORT = { width: 396, height: 600 };
-
 const tests = [];
 
 function test(name, fn) {
@@ -367,14 +359,11 @@ async function leaveTransactionDetail(page) {
     await openAddressDetail(page);
 }
 
-// Back out to Home from wherever the previous test finished, and wait for the
-// save that navigation makes, so a test reading the stored stack next reads
-// the one Home left.
+// Back out to Home from wherever the previous test finished.
 async function goHome(page) {
     await leaveTransactionDetail(page);
     await page.click("#btn-address-back");
     await visible(page, "#view-main");
-    await waitForPersisted(page, "currentView", "main", "back on Home");
 }
 
 // One field of the popup's state as it was actually persisted, read out of
@@ -1896,6 +1885,12 @@ test("a network switch in Settings shows and removes the testnet banner at once
 
 // ------------------------------------------------ dust threshold (#233)
 
+// The popup size README documents the UI as designed for. Pages in this
+// context otherwise get Playwright's 1280x720 default, at which the flash
+// line has room for any plausible message and never wraps — measuring
+// there would pass for every string and prove nothing.
+const POPUP_VIEWPORT = { width: 360, height: 600 };
+
 // Everything below the flash line that must not move when it fills, plus
 // the height of the line itself. Runs in the page.
 //
@@ -2144,7 +2139,7 @@ test("a password error moves nothing on any screen (#297)", async (env) => {
 
 // ------------------------------------------ add wallet Import button (#493)
 
-// At 396x600 the add wallet screen's Import button already starts near the
+// At 360x600 the add wallet screen's Import button already starts near the
 // bottom of the popup, so its password error line sits beside the button
 // rather than above it. Measures the button and the line empty and again
 // filled with the longest error addWallet.js puts there. Runs in the page.
@@ -3436,14 +3431,10 @@ test("six failed receipt lookups in a row end on the unreachable-network message
 // timeout ("<iframe id=\"pwn\"> intercepts pointer events") rather than as
 // anything that names the defect.
 
-// The issue's reproduction, with the frame sized to the popup.
+// Verbatim from the issue's reproduction.
 const HOSTILE_SYMBOL =
     '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:' +
-    POPUP_VIEWPORT.width +
-    "px;height:" +
-    POPUP_VIEWPORT.height +
-    'px;z-index:99999"></iframe>';
+    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
 
 // What a correctly escaped and capped render of it reads as: the first
 // MAX_SYMBOL_LENGTH-1 characters and an ellipsis. Spelled out rather than
@@ -3480,24 +3471,6 @@ function hostileSymbolState(page, tokenAddress) {
 }
 
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
-    // The stub token is no longer tracked from here on, so the explorer is
-    // what lists it, as it lists a token airdropped to the victim. A tracked
-    // token is listed from the RPC endpoint under the symbol it was added
-    // with, which the hostile symbol below never reaches
-    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
-    await env.page.click("#btn-settings");
-    await visible(env.page, "#view-settings");
-    await env.page.click("#settings-tracked-tokens .btn-remove-token");
-    // The list is drawn again once the removal is saved.
-    await env.page.waitForFunction(
-        () =>
-            document
-                .getElementById("settings-tracked-tokens")
-                .innerText.trim() === "None",
-    );
-    await env.page.click("#btn-settings-back");
-    await visible(env.page, "#view-address");
-
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.seedTokenBalance = true;
     env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;
@@ -4883,12 +4856,6 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         "the page was not told of the approved switch: " +
             JSON.stringify(events),
     );
-    // The popup, open all along, shows the new network
-    // (https://git.eeqj.de/sneak/AutistMask/issues/650).
-    await env.page.waitForFunction(() => {
-        const banner = document.getElementById("debug-banner");
-        return banner !== null && banner.textContent === "[TESTNET]";
-    });
 
     const restored = await openNetworkPrompt(
         env,
@@ -4910,9 +4877,6 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         isDeepStrictEqual(await storedNetwork(env.page), before),
         "switching back did not restore the mainnet network and endpoints",
     );
-    await env.page.waitForFunction(
-        () => document.getElementById("debug-banner") === null,
-    );
 });
 
 // Switching the network in Settings tells the page too, as an approved site
@@ -5062,20 +5026,8 @@ function addressRowReport(page) {
     });
 }
 
-// Measured at the popup's 396x600 (POPUP_VIEWPORT). Every page in this
-// context, approval windows included, is otherwise 1280x720 whatever size
-// the extension asks for, and a page that wide never scrolls sideways. The
-// page is then put back to the size it had, so the size a later step runs at
-// does not depend on whether this one ran.
 async function assertAddressesFit(page, where) {
-    const sizeBefore = page.viewportSize();
-    await page.setViewportSize(POPUP_VIEWPORT);
-    let report;
-    try {
-        report = await addressRowReport(page);
-    } finally {
-        await page.setViewportSize(sizeBefore);
-    }
+    const report = await addressRowReport(page);
     assert(
         report.rows.length > 0,
         where + ": no address rows were rendered, so nothing was measured",

tests/nativeCurrency.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const { state } = require("../src/shared/state");
 const { NETWORKS } = require("../src/shared/networks");

tests/persistedEntryFloors.test.js

@@ -364,7 +364,7 @@ describe("a save that fails", () => {
         return storage;
     }
 
-    test("is reported when the caller does not await it", async () => {
+    test("is reported, not swallowed by the save queue", async () => {
         const storage = failingStorage(unversionedValidProfile());
         const { state, loadState, saveState, onSaveFailure } =
             loadStateModule(storage);

tests/popupFollowsNetworkSwitch.test.js

@@ -1,300 +0,0 @@
-// An open popup follows a network switch the background saves once the user
-// approves a site's request: it takes the new network from the stored record
-// and draws the screen it is on for it, as a switch in Settings does
-// (https://git.eeqj.de/sneak/AutistMask/issues/650). Driven through the real
-// popup over a stored profile on Ethereum Mainnet. The background's write is
-// the storage stub's set, which the stub reports to the page as the browser
-// does.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-    TOKEN_ADDRESS,
-} = require("./support/popupBoot");
-const { makeStorageStub } = require("./support/storageStub");
-const {
-    applyChainSwitchFields,
-    copyChainSwitchFields,
-} = require("../src/shared/chainSwitchFields");
-const { NETWORKS } = require("../src/shared/networks");
-const { STATE_SCHEMA_VERSION } = require("../src/shared/stateSchema");
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-const SEPOLIA_TOKEN = {
-    address: TOKEN_ADDRESS,
-    symbol: "TST",
-    decimals: 18,
-    name: "Test Token",
-};
-const MAINNET_TOKEN = {
-    address: "0x6B175474E89094C44Da98b954EedeAC495271d0F",
-    symbol: "DAI",
-    decimals: 18,
-    name: "Dai Stablecoin",
-};
-
-// A profile on Ethereum Mainnet that reopens the popup onto AddressDetail,
-// with DAI tracked there and TST tracked on Sepolia.
-function profileOnAddress() {
-    return unversionedValidProfile({
-        currentView: "address",
-        viewStack: ["main"],
-        selectedWallet: 0,
-        selectedAddress: 0,
-        trackedTokens: [MAINNET_TOKEN],
-        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
-    });
-}
-
-// The popup reopened onto it.
-function bootOnAddress() {
-    return bootPopup(profileOnAddress());
-}
-
-// The background saves a switch to `networkId`, as its updateState() does
-// once the user approves a site's request.
-async function backgroundSwitch(page, networkId) {
-    const record = page.storage.read("autistmask");
-    applyChainSwitchFields(record, networkId);
-    await page.storage.local.set({ autistmask: record });
-    await page.settle();
-    await page.settle();
-}
-
-test("the popup open on AddressDetail shows the new network and its balances", async () => {
-    const page = await bootOnAddress();
-    expect(page.pageErrors).toEqual([]);
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(page.node("address-balances").innerHTML).toContain("DAI");
-    expect(page.node("debug-banner")).toBeNull();
-
-    await backgroundSwitch(page, "sepolia");
-
-    const { state } = require("../src/shared/state");
-    expect(state.networkId).toBe("sepolia");
-    expect(state.rpcUrl).toBe(NETWORKS.sepolia.defaultRpcUrl);
-    expect(page.visibleViews()).toEqual(["address"]);
-    const balances = page.node("address-balances").innerHTML;
-    expect(balances).toContain("TST");
-    expect(balances).toContain("SepoliaETH");
-    expect(balances).not.toContain("DAI");
-    expect(page.text("debug-banner")).toBe("[TESTNET]");
-
-    // Its next refresh runs on Sepolia, and what it fetched is stored.
-    await page.tick();
-    const { refreshBalances } = require("../src/shared/balances");
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
-    const stored = page.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.lastBalanceRefresh).toBeGreaterThan(0);
-});
-
-test("the popup open on Settings shows the new network, and Back draws the screen beneath for it", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-    expect(page.visibleViews()).toEqual(["settings"]);
-
-    await backgroundSwitch(page, "sepolia");
-
-    expect(page.visibleViews()).toEqual(["settings"]);
-    expect(page.value("settings-network")).toBe("sepolia");
-    expect(page.value("settings-rpc")).toBe(NETWORKS.sepolia.defaultRpcUrl);
-    expect(page.node("settings-tracked-tokens").innerHTML).toContain("TST");
-    expect(page.text("debug-banner")).toBe("[TESTNET]");
-
-    await page.click("btn-settings-back");
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(page.node("address-balances").innerHTML).not.toContain("DAI");
-});
-
-// Neither can be drawn again for the new network: Send cannot be rendered from
-// saved state, and DAI was picked on Ethereum Mainnet, where alone it is
-// tracked. A reopened popup goes to Home in their place.
-test.each([
-    ["Send", (page) => page.click("btn-send")],
-    [
-        "AddressToken for DAI",
-        async (page) => {
-            const { state } = require("../src/shared/state");
-            state.selectedToken = MAINNET_TOKEN.address;
-            require("../src/popup/views/helpers").pushCurrentView();
-            require("../src/popup/views/addressToken").show();
-            await page.settle();
-        },
-    ],
-])("the popup open on %s goes to Home", async (_view, open) => {
-    const page = await bootOnAddress();
-    await open(page);
-    expect(page.visibleViews()).not.toEqual(["address"]);
-
-    await backgroundSwitch(page, "sepolia");
-
-    expect(page.visibleViews()).toEqual(["main"]);
-    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
-});
-
-// The report of the switch's own save names the network the page already has.
-test("a switch in Settings is not taken a second time when its save is reported", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-    const { get, set } = page.storage.local;
-    const reads = get.mock.calls.length;
-    const writes = set.mock.calls.length;
-
-    const select = page.node("settings-network");
-    select.value = "sepolia";
-    for (const fn of select.listeners.change) await fn();
-    await page.settle();
-    await page.settle();
-
-    expect(get).toHaveBeenCalledTimes(reads + 1);
-    expect(set).toHaveBeenCalledTimes(writes + 1);
-    expect(page.text("flash-msg")).toBe("Switched to Sepolia Testnet.");
-});
-
-// The background saves the switch once the popup has read the stored record
-// and before it listens for changes to it, so the browser tells the page
-// nothing of it. Nor is any later write reported here: Chrome reports none
-// that leaves the record as it was, such as the popup's own save at start-up.
-test("a switch saved while the popup opens, before it listens for one, is followed", async () => {
-    const storage = makeStorageStub({ autistmask: profileOnAddress() });
-    storage.onChanged = { addListener: () => {} };
-    const read = storage.local.get.getMockImplementation();
-    storage.local.get.mockImplementationOnce(async (key) => {
-        const loaded = await read(key);
-        const record = storage.read("autistmask");
-        applyChainSwitchFields(record, "sepolia");
-        storage.write("autistmask", record);
-        return loaded;
-    });
-    const page = await bootPopup(undefined, { storage });
-    await page.settle();
-
-    const { state } = require("../src/shared/state");
-    expect(page.pageErrors).toEqual([]);
-    expect(state.networkId).toBe("sepolia");
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(page.node("address-balances").innerHTML).toContain("SepoliaETH");
-    expect(page.text("debug-banner")).toBe("[TESTNET]");
-});
-
-// While the popup's follow of the background's switch to Sepolia waits for the
-// lock, the user picks Sepolia in Settings and then Ethereum Mainnet again. The
-// last pick is the network stored, and the last one sites are told of.
-test("a switch in Settings made while a follow waits for the lock is not overwritten by it", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-
-    // Another write holds the lock, so every save of the page waits for it.
-    let releaseLock;
-    const lockHeld = navigator.locks.request(
-        "autistmask",
-        () =>
-            new Promise((resolve) => {
-                releaseLock = resolve;
-            }),
-    );
-    await backgroundSwitch(page, "sepolia");
-    const select = page.node("settings-network");
-    const picks = [];
-    for (const networkId of ["sepolia", "mainnet"]) {
-        select.value = networkId;
-        for (const fn of select.listeners.change) picks.push(fn());
-    }
-    releaseLock();
-    await lockHeld;
-    await Promise.all(picks);
-    await page.settle();
-
-    const { state } = require("../src/shared/state");
-    expect(state.networkId).toBe("mainnet");
-    expect(page.storage.read("autistmask").networkId).toBe("mainnet");
-    expect(page.value("settings-network")).toBe("mainnet");
-    const told = globalThis.chrome.runtime.sendMessage.mock.calls
-        .map(([message]) => message)
-        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
-    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
-});
-
-// The popup follows the background's switch to Sepolia, but its own write in
-// that save fails. The user then picks Ethereum Mainnet in Settings, the
-// network the popup was on before: that switch is stored, and only then
-// flashed and sent to sites.
-test("a switch back in Settings after a follow whose write failed is stored", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-    const { set } = page.storage.local;
-    const write = set.getMockImplementation();
-    // The background's write lands; the next, the follow's, fails.
-    set.mockImplementationOnce(write).mockRejectedValueOnce(
-        new Error("quota exceeded"),
-    );
-    await backgroundSwitch(page, "sepolia");
-    const { state } = require("../src/shared/state");
-    expect(state.networkId).toBe("sepolia");
-
-    const select = page.node("settings-network");
-    select.value = "mainnet";
-    for (const fn of select.listeners.change) await fn();
-    await page.settle();
-
-    const stored = page.storage.read("autistmask");
-    expect(stored.networkId).toBe("mainnet");
-    expect(stored.rpcUrl).toBe(NETWORKS.mainnet.defaultRpcUrl);
-    expect(stored.trackedTokens).toEqual([MAINNET_TOKEN]);
-    expect(page.text("flash-msg")).toBe("Switched to Ethereum Mainnet.");
-    const told = globalThis.chrome.runtime.sendMessage.mock.calls
-        .map(([message]) => message)
-        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
-    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
-});
-
-// Such as one a newer build wrote, which this build cannot read. Nothing reads
-// or writes the stored record for it: the popup's next save finds it, as
-// before.
-test("a record that names no network is not followed", async () => {
-    const page = await bootOnAddress();
-    const { get, set } = page.storage.local;
-    const reads = get.mock.calls.length;
-
-    await set({
-        autistmask: {
-            schemaVersion: STATE_SCHEMA_VERSION + 1,
-            wallets: [{ type: "hd", name: "Main", addresses: [] }],
-        },
-    });
-    await page.settle();
-
-    expect(get).toHaveBeenCalledTimes(reads);
-    expect(page.visibleViews()).toEqual(["address"]);
-});
-
-// A record that takes the switch from the switched record ends up as that
-// record, balances the background fetched since included.
-test("copyChainSwitchFields() takes every field applyChainSwitchFields() sets", () => {
-    const before = unversionedValidProfile({
-        trackedTokens: [MAINNET_TOKEN],
-        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
-        networkEndpoints: {
-            sepolia: {
-                rpcUrl: "http://127.0.0.1:8545",
-                blockscoutUrl: "http://127.0.0.1:4000/api/v2",
-            },
-        },
-        lastBalanceRefresh: 1,
-        tokenHolderCache: { [MAINNET_TOKEN.address]: 5000 },
-        fraudContracts: ["0x1111111111111111111111111111111111111111"],
-    });
-    const switched = structuredClone(before);
-    applyChainSwitchFields(switched, "sepolia");
-    switched.wallets[0].addresses[0].balance = "2.0";
-
-    const follower = structuredClone(before);
-    copyChainSwitchFields(follower, switched);
-
-    expect(follower).toEqual(switched);
-});

tests/sendAmountRule.test.js

@@ -97,7 +97,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const { state } = require("../src/shared/state");
 const send = require("../src/popup/views/send");

tests/sendDisplayFloor.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const { refreshBalances } = require("../src/shared/balances");
 const { state } = require("../src/shared/state");

tests/sendMax.test.js

@@ -146,7 +146,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const { Transaction, Wallet, formatEther } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");

tests/stateMerge.test.js

@@ -160,7 +160,7 @@ describe("the approval-window reproduction", () => {
         await approvalWindow.state.loadState();
         approvalWindow.helpers.showView("approve-tx");
         // showView() does not await its own saveState(); an extra save
-        // waits for the lock behind that one and so resolves only after it,
+        // joins the same queue and only resolves once that one has too,
         // which is the black-box way to know it landed.
         await approvalWindow.state.saveState();
 

tests/stateWriteLock.test.js

@@ -1,96 +0,0 @@
-// A popup save reads the stored record, merges this page's changes into it
-// and writes it back. The background's write of a network the user approved
-// used to be able to land between that read and that write, and the popup's
-// write then put the old network back
-// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every write of the record
-// now holds a lock from its read to its write.
-//
-// The popup and the background run here as the real modules over one shared
-// storage stub, and share the lock the way the background and a page outside
-// a Firefox private window share the browser's
-// (tests/support/navigatorLocks.js).
-
-const { makeStorageStub } = require("./support/storageStub");
-
-function loadContexts(storage) {
-    jest.resetModules();
-    globalThis.chrome = { storage: { local: storage.local } };
-    return {
-        popup: require("../src/shared/state"),
-        background: require("../src/background/state"),
-        applyChainSwitchFields: require("../src/shared/chainSwitchFields")
-            .applyChainSwitchFields,
-    };
-}
-
-// Lets every pending promise callback run, and then some.
-function nextMacrotask() {
-    return new Promise((resolve) => setImmediate(resolve));
-}
-
-afterEach(() => {
-    delete globalThis.chrome;
-    jest.restoreAllMocks();
-});
-
-test("a network the background switches to during a popup save stays stored", async () => {
-    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
-    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
-    await popup.loadState();
-
-    // The popup navigates, so its save has a change of its own to write.
-    popup.state.currentView = "settings";
-
-    // The popup's save has read the record and is about to write it back when
-    // the user's approval of a site's switch to mainnet reaches the
-    // background. Without the lock the background's whole update runs before
-    // the next macrotask; with it, the update waits for the popup's write.
-    let backgroundSwitch;
-    const realSet = storage.local.set.getMockImplementation();
-    storage.local.set.mockImplementationOnce(async (items) => {
-        backgroundSwitch = background.updateState((fresh) =>
-            applyChainSwitchFields(fresh, "mainnet"),
-        );
-        await nextMacrotask();
-        return realSet(items);
-    });
-
-    await popup.saveState();
-    await backgroundSwitch;
-
-    const stored = storage.read("autistmask");
-    expect(stored.networkId).toBe("mainnet");
-    expect(stored.currentView).toBe("settings");
-});
-
-test("after a save that failed, the next save still keeps a network the background switches to during it", async () => {
-    jest.spyOn(console, "error").mockImplementation(() => {});
-    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
-    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
-    await popup.loadState();
-    popup.state.currentView = "settings";
-
-    // The first save's write is refused, so it gives the lock back having
-    // failed.
-    storage.local.set.mockRejectedValueOnce(new Error("quota exceeded"));
-    await expect(popup.saveState()).rejects.toThrow("quota exceeded");
-
-    // The next save is between its read and its write when the background
-    // switches to mainnet, as in the test above.
-    let backgroundSwitch;
-    const realSet = storage.local.set.getMockImplementation();
-    storage.local.set.mockImplementationOnce(async (items) => {
-        backgroundSwitch = background.updateState((fresh) =>
-            applyChainSwitchFields(fresh, "mainnet"),
-        );
-        await nextMacrotask();
-        return realSet(items);
-    });
-
-    await popup.saveState();
-    await backgroundSwitch;
-
-    const stored = storage.read("autistmask");
-    expect(stored.networkId).toBe("mainnet");
-    expect(stored.currentView).toBe("settings");
-});

tests/support/navigatorLocks.js

@@ -1,27 +0,0 @@
-// `navigator.locks` for the unit tests, which run on node, where there is none.
-//
-// One lock per name: granted in the order it was asked for, and let go when
-// the callback settles, whether it resolved or rejected. That is what the
-// browser's own does for the one call the extension makes,
-// `navigator.locks.request(name, callback)`. Every module a test file loads
-// shares it, as the extension's background and its pages share the browser's,
-// except a page in a Firefox private window (README, "Stored state and its
-// version").
-//
-// Run before each test file by `setupFiles` in package.json.
-
-// For each name, a promise that settles once the last request for it has
-// let the lock go.
-const released = new Map();
-
-function request(name, callback) {
-    const previous = released.get(name) || Promise.resolve();
-    const result = previous.then(() => callback({ name, mode: "exclusive" }));
-    released.set(
-        name,
-        result.catch(() => {}),
-    );
-    return result;
-}
-
-globalThis.navigator = { locks: { request } };

tests/support/popupBoot.js

@@ -311,7 +311,7 @@ async function bootPopup(stored, options) {
     const windowListeners = {};
 
     globalThis.chrome = {
-        storage: { local: storage.local, onChanged: storage.onChanged },
+        storage: { local: storage.local },
         runtime: {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,

tests/support/storageStub.js

@@ -18,9 +18,7 @@
 // a storage stub by hand.
 
 // One storage area: get, set and remove over its own store, cloning both ways.
-// `changed` is handed what each set or remove changed, in the shape
-// storage.onChanged reports it.
-function makeArea(store, tick, changed) {
+function makeArea(store, tick) {
     const get = jest.fn(async (key) => {
         tick();
         if (key === undefined || key === null) return structuredClone(store);
@@ -36,25 +34,14 @@ function makeArea(store, tick, changed) {
 
     const set = jest.fn(async (items) => {
         tick();
-        const changes = {};
         for (const k of Object.keys(items)) {
-            changes[k] = structuredClone({
-                oldValue: store[k],
-                newValue: items[k],
-            });
             store[k] = structuredClone(items[k]);
         }
-        changed(changes);
     });
 
     const remove = jest.fn(async (key) => {
         tick();
-        const changes = {};
-        for (const k of Array.isArray(key) ? key : [key]) {
-            changes[k] = { oldValue: store[k] };
-            delete store[k];
-        }
-        changed(changes);
+        for (const k of Array.isArray(key) ? key : [key]) delete store[k];
     });
 
     return { get, set, remove };
@@ -67,22 +54,12 @@ function makeArea(store, tick, changed) {
 function makeStorageStub(initial, onOp) {
     const store = initial ? structuredClone(initial) : {};
     const tick = onOp || (() => {});
-    // storage.onChanged: after a set or remove has finished, every listener is
-    // called with what it changed and the area's name, as the browser calls
-    // them for a write by any page or the background.
-    const listeners = [];
-    const announce = (areaName) => (changes) => {
-        Promise.resolve().then(() => {
-            for (const fn of listeners) fn(structuredClone(changes), areaName);
-        });
-    };
-    const local = makeArea(store, tick, announce("local"));
+    const local = makeArea(store, tick);
 
     return {
         // Drop this straight in as chrome.storage.
         local,
-        session: makeArea({}, tick, announce("session")),
-        onChanged: { addListener: (fn) => listeners.push(fn) },
+        session: makeArea({}, tick),
         get: local.get,
         set: local.set,
         remove: local.remove,
@@ -94,9 +71,7 @@ function makeStorageStub(initial, onOp) {
                 ? structuredClone(store)
                 : structuredClone(store[key]),
         // Seed or replace a record without going through the module under
-        // test — for standing in as "another page wrote this". Nothing is
-        // announced to storage.onChanged, so it also stands in for the time
-        // before the browser tells this page of such a write.
+        // test — for standing in as "another page wrote this".
         write: (key, value) => {
             store[key] = structuredClone(value);
         },

tests/trackedTokenBalances.test.js

@@ -1,303 +0,0 @@
-// The balance of each token the user tracks is read with balanceOf through the
-// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
-// holder count and decimals, and adds the tokens the user has not tracked
-// (https://git.eeqj.de/sneak/AutistMask/issues/669).
-//
-// The real refreshBalances() runs against a fake JSON-RPC node, answered
-// through ethers' own request hook, and a fake Blockscout, answered through
-// fetch().
-
-const { AbiCoder, FetchRequest } = require("ethers");
-const { refreshBalances } = require("../src/shared/balances");
-
-const RPC_URL = "https://rpc.example.invalid";
-const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
-const FIRST = "0x1111111111111111111111111111111111111111";
-const SECOND = "0x2222222222222222222222222222222222222222";
-
-// A token the user tracks, outside the bundled list, at 6 decimals.
-const TOKEN = "0x7777777777777777777777777777777777777777";
-const TRACKED = {
-    address: TOKEN,
-    symbol: "TRK",
-    name: "Tracked Token",
-    decimals: 6,
-};
-
-// USDC, from the bundled list, which the user does not track.
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
-// Neither on the bundled list nor tracked.
-const OTHER = "0x8888888888888888888888888888888888888888";
-
-const ZERO_WORD = "0x" + "0".repeat(64);
-const BALANCE_OF = "0x70a08231";
-
-// What balanceOf answers, by token contract and then by holder. A pair that is
-// not here makes balanceOf fail.
-let holdings;
-// What Blockscout answers for every address; null makes the request fail.
-let explorerRows;
-let logged;
-
-// One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
-// answered with no resolver, so no name.
-function reply(req) {
-    const envelope = { jsonrpc: "2.0", id: req.id };
-    if (req.method === "eth_getBalance") {
-        return { ...envelope, result: "0x0" };
-    }
-    if (req.method !== "eth_call") {
-        return {
-            ...envelope,
-            error: { code: -32601, message: "method not found" },
-        };
-    }
-    const { to, data } = req.params[0];
-    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
-    const holder = "0x" + data.slice(-40);
-    const amount = (holdings[to.toLowerCase()] || {})[holder];
-    if (amount === undefined) {
-        return {
-            ...envelope,
-            error: { code: -32000, message: "fixture: balanceOf failed" },
-        };
-    }
-    return {
-        ...envelope,
-        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
-    };
-}
-
-const realFetch = globalThis.fetch;
-
-beforeEach(() => {
-    holdings = {};
-    explorerRows = null;
-    logged = [];
-    jest.spyOn(console, "error").mockImplementation((...args) => {
-        logged.push(args.map(String).join(" "));
-    });
-    FetchRequest.registerGetUrl(async (req) => {
-        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
-        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
-        return {
-            statusCode: 200,
-            statusMessage: "OK",
-            headers: { "content-type": "application/json" },
-            body: Buffer.from(JSON.stringify(answer)),
-        };
-    });
-    globalThis.fetch = jest.fn(async () => {
-        if (explorerRows === null) throw new TypeError("Failed to fetch");
-        return { ok: true, status: 200, json: async () => explorerRows };
-    });
-});
-
-afterEach(() => {
-    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
-    globalThis.fetch = realFetch;
-    jest.restoreAllMocks();
-});
-
-// One Blockscout token-balances row.
-function explorerRow(address, symbol, value, holders = "50000") {
-    return {
-        value: String(value),
-        token: {
-            type: "ERC-20",
-            address_hash: address,
-            symbol: symbol,
-            name: symbol,
-            decimals: "6",
-            holders_count: holders,
-        },
-    };
-}
-
-// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
-// decimals and holder count Blockscout reported for it, if any.
-function trackedRow(balance, decimals = null, holders = null) {
-    return {
-        address: TOKEN,
-        name: "Tracked Token",
-        symbol: "TRK",
-        decimals: decimals,
-        balance: balance,
-        holders: holders,
-    };
-}
-
-async function refresh(addresses, trackedTokens) {
-    await refreshBalances(
-        [{ addresses }],
-        RPC_URL,
-        EXPLORER_URL,
-        trackedTokens,
-        "mainnet",
-        new AbortController().signal,
-    );
-    return addresses;
-}
-
-test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
-    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
-    const [first, second] = await refresh(
-        [
-            { address: FIRST, tokenBalances: [] },
-            { address: SECOND, tokenBalances: [] },
-        ],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
-    // Exact, never cut: one base unit is not zero.
-    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
-});
-
-test("with Blockscout failing, the untracked rows from before stay", async () => {
-    holdings[TOKEN] = { [FIRST]: 2000000n };
-    const usdc = {
-        address: USDC,
-        name: "USD Coin",
-        symbol: "USDC",
-        decimals: 6,
-        balance: "5.0",
-        holders: 50000,
-    };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [usdc] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
-});
-
-test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
-    holdings[TOKEN] = { [FIRST]: 2000000n };
-    explorerRows = [
-        explorerRow(TOKEN, "TRK", 9000000),
-        explorerRow(USDC, "USDC", 5000000),
-        // Too few holders, and neither on the bundled list nor tracked.
-        explorerRow(OTHER, "SPAM", 5000000, "10"),
-        // A known symbol from a contract it does not belong to.
-        explorerRow(OTHER, "USDC", 5000000),
-    ];
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([
-        trackedRow("2.0", 6, 50000),
-        {
-            address: USDC,
-            name: "USDC",
-            symbol: "USDC",
-            decimals: 6,
-            balance: "5.0",
-            holders: 50000,
-        },
-    ]);
-});
-
-test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
-    holdings[TOKEN] = { [FIRST]: 2000000n };
-    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
-    // through to Send's token list.
-    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
-});
-
-test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
-    holdings[TOKEN] = { [FIRST]: 2000000n };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
-});
-
-test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
-    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
-    const before = trackedRow("7.0", 6, 50000);
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [before] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([before]);
-    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
-        true,
-    );
-});
-
-test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
-    // balanceOf fails at FIRST and answers at SECOND.
-    holdings[TOKEN] = { [SECOND]: 2000000n };
-    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
-    const [first, second] = await refresh(
-        [
-            { address: FIRST, tokenBalances: [] },
-            { address: SECOND, tokenBalances: [] },
-        ],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([
-        {
-            address: TOKEN,
-            name: "TRK",
-            symbol: "TRK",
-            decimals: 6,
-            balance: "9.0",
-            holders: 50000,
-        },
-    ]);
-    // Where balanceOf answers, its figure stands.
-    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
-});
-
-test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
-    holdings[TOKEN] = { [FIRST]: 0n };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
-        [TRACKED],
-    );
-    expect(first.tokenBalances).toEqual([]);
-});
-
-test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
-    holdings[TOKEN] = { [FIRST]: 5n };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [{ ...TRACKED, decimals: null }],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow(null)]);
-});
-
-test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
-    holdings[TOKEN] = { [FIRST]: 2000000n };
-    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [{ ...TRACKED, decimals: null }],
-    );
-    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
-});
-
-test("a tracked token wearing a known symbol from another contract is not listed", async () => {
-    holdings[OTHER] = { [FIRST]: 5000000n };
-    // Its entry from before goes too, although Blockscout fails.
-    const before = {
-        address: OTHER,
-        name: "Fake",
-        symbol: "USDC",
-        decimals: 6,
-        balance: "5.0",
-        holders: 50000,
-    };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [before] }],
-        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
-    );
-    expect(first.tokenBalances).toEqual([]);
-});

tests/trackedTokensPerNetwork.test.js

@@ -161,7 +161,6 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
     );
     expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
 
-    await boot.click("btn-settings");
     await chooseNetwork(boot, "mainnet");
     expect(stored().networkId).toBe("mainnet");
     expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);

tests/uniswapRecipient.test.js

@@ -7,12 +7,9 @@
 // (https://git.eeqj.de/sneak/AutistMask/issues/592), the address whose
 // balance a BALANCE_CHECK_ERC20 checks
 // (https://git.eeqj.de/sneak/AutistMask/issues/600), any token a swap
-// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606),
+// leaves in the router (https://git.eeqj.de/sneak/AutistMask/issues/606), and
 // what each PERMIT2_TRANSFER_FROM moves
-// (https://git.eeqj.de/sneak/AutistMask/issues/611), and when an
-// UNWRAP_WETH makes the output ETH
-// (https://git.eeqj.de/sneak/AutistMask/issues/607 and
-// https://git.eeqj.de/sneak/AutistMask/issues/642).
+// (https://git.eeqj.de/sneak/AutistMask/issues/611).
 //
 // Every swap command, SWEEP, WRAP_ETH, UNWRAP_WETH, TRANSFER, PAY_PORTION,
 // PAY_PORTION_FULL_PRECISION, PERMIT2_TRANSFER_FROM, ACROSS_V4_DEPOSIT_V3 and
@@ -271,28 +268,18 @@ const SWAP_USDT_FOR_ETH = [
         [[[ZERO, USDT, 500, 10, ZERO], false, USDT_2000, ONE_WETH, "0x"]],
     ),
 ];
-const SWAP_USDT_FOR_WETH = [
-    0x06, // SWAP_EXACT_IN_SINGLE
-    coder.encode(
-        [
-            "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
-        ],
-        [[[USDT, WETH, 500, 10, ZERO], true, USDT_2000, ONE_WETH, "0x"]],
-    ),
-];
 // SWAP_EXACT_IN_SINGLE with no parameters, which cannot be read.
 const UNREADABLE_SWAP = [0x06, "0x"];
 const SETTLE_USDT = [
     0x0b,
     coder.encode(["address", "uint256", "bool"], [USDT, 0n, true]),
 ];
-// A TAKE of `amount`, by default zero: the open delta, all the step owes.
-function take(currency, recipient, amount = 0n) {
+function take(currency, recipient) {
     return [
         0x0e,
         coder.encode(
             ["address", "address", "uint256"],
-            [currency, recipient, amount],
+            [currency, recipient, 0n],
         ),
     ];
 }
@@ -400,18 +387,6 @@ describe("each swap command's recipient", () => {
             data: (r) => execute(swapToWeth(r)),
             min: "1.0000 WETH",
         },
-        {
-            // Its input has V3_SWAP_EXACT_IN's layout, with amountOut and
-            // amountInMax in place of amountIn and amountOutMin, and a path
-            // that lists the token bought first.
-            kind: "V3_SWAP_EXACT_OUT",
-            data: (r) =>
-                execute([
-                    0x01,
-                    v3SwapExactIn(r, ONE_WETH, USDT_2000, WETH, USDT)[1],
-                ]),
-            min: "1.0000 WETH",
-        },
         {
             kind: "V4_SWAP with TAKE",
             data: (r) =>
@@ -544,7 +519,7 @@ describe("an output left in the router is not received", () => {
         {
             kind: "an UNWRAP_WETH to the user, then the swap",
             data: execute(unwrapWeth(MSG_SENDER), toRouter),
-            min: "1.0000 WETH",
+            min: "1.0000 ETH",
         },
         {
             kind: "the swap, then a WRAP_ETH of zero to the user",
@@ -581,530 +556,6 @@ describe("an output left in the router is not received", () => {
     });
 });
 
-// https://git.eeqj.de/sneak/AutistMask/issues/607: an UNWRAP_WETH pays out,
-// as ETH, the WETH the router holds when it runs. Token Out read ETH whenever
-// the output side was WETH, so a swap that paid its WETH to the user before
-// the UNWRAP_WETH read as ETH, though the user receives WETH.
-describe("an UNWRAP_WETH makes the output ETH only when the router holds it", () => {
-    test("a swap paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
-        const result = decode(
-            execute(swapToWeth(MSG_SENDER), unwrapWeth(MSG_SENDER)),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(labels(result)).toEqual(PAID_TO_USER);
-        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
-    });
-
-    test("a swap paying its WETH to the router, then an UNWRAP_WETH to the user, reads as ETH", () => {
-        const result = decode(
-            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER)),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(labels(result)).toEqual(PAID_TO_USER);
-        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
-    });
-
-    // The SWEEP pays the user all the WETH the router holds, so the
-    // UNWRAP_WETH finds none of it.
-    test("a swap paying its WETH to the router, then a SWEEP of it to the user, then an UNWRAP_WETH, reads as WETH", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                sweep(WETH, MSG_SENDER),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
-    });
-
-    // The user receives the first step's WETH as WETH and the second's as
-    // ETH. The second step sets the output side and pays its WETH to the
-    // router, so the output reads as ETH with the second step's minimum.
-    test("two swaps, the second paying its WETH to the router, then an UNWRAP_WETH, reads as ETH", () => {
-        const result = decode(
-            execute(
-                swapToWeth(MSG_SENDER),
-                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
-                    USDC,
-                    WETH,
-                ]),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Min. received").value).toBe("0.5000 ETH");
-    });
-
-    // The same two swaps the other way round. The user receives the first
-    // step's WETH as ETH and the second's as WETH. The second step sets the
-    // output side and pays its WETH to the user, so the output reads as WETH
-    // with the second step's minimum, though the router holds the first's.
-    test("two swaps, the second paying its WETH to the user, then an UNWRAP_WETH, reads as WETH", () => {
-        const result = decode(
-            execute(
-                v2Swap(0x08, ADDRESS_THIS, USDC_1990, ONE_WETH / 2n, [
-                    USDC,
-                    WETH,
-                ]),
-                swapToWeth(MSG_SENDER),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDC → WETH");
-        expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
-    });
-
-    // One V4 step buys at least 1 WETH and TAKEs 0.6 WETH to the user and the
-    // rest to the router. The user receives 0.6 WETH and the rest as ETH.
-    // Neither minimum is shown: the decoder does not count how much of the
-    // step's minimum reaches the router, nor read the UNWRAP_WETH's own.
-    test("one V4 step paying part of its WETH to the user and the rest to the router, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
-        const result = decode(
-            execute(
-                v4Swap(
-                    SWAP_USDT_FOR_WETH,
-                    SETTLE_USDT,
-                    take(WETH, MSG_SENDER, (ONE_WETH * 6n) / 10n),
-                    take(WETH, ADDRESS_THIS),
-                ),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(labels(result)).toEqual([
-            "Protocol",
-            "Token In",
-            "Amount",
-            "Token Out",
-            "Steps",
-            "Deadline",
-        ]);
-    });
-
-    // A TAKE the decoder cannot read may pay part of the WETH to the user.
-    test("one V4 step paying WETH to the router beside a TAKE that cannot be read, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
-        const result = decode(
-            execute(
-                v4Swap(
-                    SWAP_USDT_FOR_WETH,
-                    SETTLE_USDT,
-                    withDirtyWord(take(WETH, MSG_SENDER), 1),
-                    take(WETH, ADDRESS_THIS),
-                ),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Min. received")).toBeUndefined();
-        expect(detail(result, "Min. paid out")).toBeUndefined();
-    });
-
-    // A step after the UNWRAP_WETH that sets the output side sets it anew.
-    test("a swap paying WETH to the user after an UNWRAP_WETH of an earlier swap's WETH reads as WETH", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                unwrapWeth(MSG_SENDER),
-                v2Swap(0x08, MSG_SENDER, USDC_1990, ONE_WETH / 2n, [
-                    USDC,
-                    WETH,
-                ]),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(detail(result, "Min. received").value).toBe("0.5000 WETH");
-    });
-
-    // The EXECUTE_SUB_PLAN's own steps, which the decoder does not read, buy
-    // the user USDC as well, so Token Out is not named.
-    test("a swap paying its WETH to the router, then an UNWRAP_WETH, then an EXECUTE_SUB_PLAN, names no Token Out", () => {
-        const subPlan = [
-            0x21,
-            coder.encode(
-                ["bytes", "bytes[]"],
-                [
-                    "0x00",
-                    [
-                        v3SwapExactIn(
-                            MSG_SENDER,
-                            USDT_2000,
-                            USDC_1990,
-                            USDT,
-                            USDC,
-                        )[1],
-                    ],
-                ],
-            ),
-        ];
-        const result = decode(
-            execute(swapToWeth(ADDRESS_THIS), unwrapWeth(MSG_SENDER), subPlan),
-        );
-        expect(result.name).toBe("Uniswap Swap");
-        expect(detail(result, "Token Out").value).toBe(UNDECODED);
-        expect(detail(result, "Min. received")).toBeUndefined();
-    });
-});
-
-// https://git.eeqj.de/sneak/AutistMask/issues/642: a step between the swap and
-// the UNWRAP_WETH may take WETH out of the router or pay it WETH, and a step
-// after an UNWRAP_WETH into the router may pay its ETH out as WETH, yet each
-// route read as ETH with the swap's minimum. A step the decoder read that is a
-// PERMIT2_PERMIT, a BALANCE_CHECK_ERC20, or a SWEEP, TRANSFER, PAY_PORTION or
-// PAY_PORTION_FULL_PRECISION of a token other than WETH, and not of ETH to a
-// WETH contract, cannot take WETH out of the router or pay anyone WETH; the
-// decoder treats every other step as one that may.
-describe("what reaches the UNWRAP_WETH of the swap's WETH", () => {
-    const NO_MINIMUM_TO_USER = PAID_TO_USER.filter(
-        (l) => l !== "Min. received",
-    );
-    const NO_MINIMUM_ELSEWHERE = PAID_ELSEWHERE.filter(
-        (l) => l !== "Min. paid out",
-    );
-
-    test.each([
-        {
-            kind: "a TRANSFER of 0.0025 WETH",
-            step: transfer(0x05, WETH, OTHER, ONE_WETH / 400n),
-        },
-        {
-            kind: "a PAY_PORTION of 25 bips",
-            step: transfer(0x06, WETH, OTHER, 25n),
-        },
-        {
-            kind: "a PAY_PORTION_FULL_PRECISION of 1e15",
-            step: transfer(0x07, WETH, OTHER, 10n ** 15n),
-        },
-    ])(
-        "$kind to another address between them reads as ETH with no minimum",
-        ({ step }) => {
-            const result = decode(
-                execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
-                USER,
-                ROUTER_V2_1_2,
-            );
-            expect(result.name).toBe("Swap USDT → ETH");
-            expect(labels(result)).toEqual(NO_MINIMUM_ELSEWHERE);
-            expect(paidTo(result)).toEqual([OTHER]);
-        },
-    );
-
-    test.each([
-        {
-            kind: "a SWEEP whose recipient cannot be read",
-            step: withDirtyWord(sweep(WETH, OTHER), 1),
-        },
-        {
-            kind: "a V4 SETTLE of 0.5 WETH from the router",
-            step: v4Swap([
-                0x0b,
-                coder.encode(
-                    ["address", "uint256", "bool"],
-                    [WETH, ONE_WETH / 2n, false],
-                ),
-            ]),
-        },
-        {
-            kind: "a bridge deposit of 0.5 WETH",
-            step: acrossDeposit(USER, USER, WETH, ONE_WETH / 2n),
-        },
-        {
-            kind: "a PERMIT2_TRANSFER_FROM of 0.5 WETH into the router",
-            step: permit2TransferFrom(WETH, ADDRESS_THIS, ONE_WETH / 2n),
-        },
-    ])("$kind between them reads as ETH with no minimum", ({ step }) => {
-        const result = decode(
-            execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Min. received")).toBeUndefined();
-        expect(detail(result, "Min. paid out")).toBeUndefined();
-    });
-
-    test.each([
-        {
-            kind: "a PERMIT2_PERMIT between them",
-            steps: [permit2Permit(USDT, USDT_2000), unwrapWeth(MSG_SENDER)],
-        },
-        {
-            kind: "a BALANCE_CHECK_ERC20 of another address between them",
-            steps: [balanceCheck(USDC, 1n, OTHER), unwrapWeth(MSG_SENDER)],
-        },
-        {
-            kind: "a BALANCE_CHECK_ERC20 of the sender with a zero minimum between them",
-            steps: [balanceCheck(USDC, 0n), unwrapWeth(MSG_SENDER)],
-        },
-        {
-            kind: "a SWEEP of USDC between them",
-            steps: [sweep(USDC, MSG_SENDER), unwrapWeth(MSG_SENDER)],
-        },
-        {
-            kind: "an UNWRAP_WETH into the router, then a SWEEP of its ETH,",
-            steps: [unwrapWeth(ADDRESS_THIS), sweep(ZERO, MSG_SENDER)],
-        },
-    ])("$kind reads as ETH with the swap's minimum", ({ steps }) => {
-        const result = decode(execute(swapToWeth(ADDRESS_THIS), ...steps));
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
-    });
-
-    test("a V4 step that TAKEs its WETH to the router, then an UNWRAP_WETH to the user, reads as ETH with the swap's minimum", () => {
-        const result = decode(
-            execute(
-                v4Swap(
-                    SWAP_USDT_FOR_WETH,
-                    SETTLE_USDT,
-                    take(WETH, ADDRESS_THIS),
-                ),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
-    });
-
-    test.each([
-        {
-            kind: "a TRANSFER of 100 USDC",
-            step: transfer(0x05, USDC, OTHER, 100000000n),
-        },
-        {
-            kind: "a PAY_PORTION of 25 bips of USDC",
-            step: transfer(0x06, USDC, OTHER, 25n),
-        },
-        {
-            kind: "a PAY_PORTION_FULL_PRECISION of 1e15 of USDC",
-            step: transfer(0x07, USDC, OTHER, 10n ** 15n),
-        },
-    ])(
-        "$kind to another address between them reads as ETH with the swap's minimum",
-        ({ step }) => {
-            const result = decode(
-                execute(swapToWeth(ADDRESS_THIS), step, unwrapWeth(MSG_SENDER)),
-                USER,
-                ROUTER_V2_1_2,
-            );
-            expect(result.name).toBe("Swap USDT → ETH");
-            expect(paidTo(result)).toEqual([OTHER]);
-            expect(detail(result, "Min. paid out").value).toBe("1.0000 ETH");
-        },
-    );
-
-    test.each([
-        {
-            kind: "a TRANSFER of 0.0025 ETH",
-            step: transfer(0x05, ZERO, OTHER, ONE_WETH / 400n),
-        },
-        {
-            kind: "a PAY_PORTION of 25 bips of its ETH",
-            step: transfer(0x06, ZERO, OTHER, 25n),
-        },
-        {
-            kind: "a PAY_PORTION_FULL_PRECISION of 1e15 of its ETH",
-            step: transfer(0x07, ZERO, OTHER, 10n ** 15n),
-        },
-    ])(
-        "an UNWRAP_WETH into the router, then $kind to another address, then a SWEEP of its ETH to the user, reads as ETH with the swap's minimum",
-        ({ step }) => {
-            const result = decode(
-                execute(
-                    swapToWeth(ADDRESS_THIS),
-                    unwrapWeth(ADDRESS_THIS),
-                    step,
-                    sweep(ZERO, MSG_SENDER),
-                ),
-                USER,
-                ROUTER_V2_1_2,
-            );
-            expect(result.name).toBe("Swap USDT → ETH");
-            expect(paidTo(result)).toEqual([OTHER]);
-            expect(detail(result, "Min. paid out").value).toBe("1.0000 ETH");
-        },
-    );
-
-    // The SWEEP pays the user the swap's WETH, so the UNWRAP_WETH unwraps the
-    // WRAP_ETH's.
-    test("a SWEEP of the swap's WETH to the user, then a WRAP_ETH into the router, reads as ETH with no minimum", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                sweep(WETH, MSG_SENDER),
-                wrapEth(ADDRESS_THIS, ONE_WETH),
-                unwrapWeth(MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
-    });
-
-    test("an UNWRAP_WETH into the router, then a WRAP_ETH of all its ETH to the user, reads as WETH with no minimum", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                unwrapWeth(ADDRESS_THIS),
-                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
-    });
-
-    // The router reads the recipient from the last 20 bytes of its word,
-    // here address(2), the router itself.
-    test("an UNWRAP_WETH whose recipient cannot be read, then a WRAP_ETH of all the router's ETH to the user, reads as WETH with no minimum", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                withDirtyWord(unwrapWeth(ADDRESS_THIS), 0),
-                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(detail(result, "Min. received")).toBeUndefined();
-        expect(detail(result, "Min. paid out")).toBeUndefined();
-    });
-
-    // The first UNWRAP_WETH may pay the router the swap's output as ETH, and
-    // the WRAP_ETH to the user pays all of it out as WETH, so the last
-    // UNWRAP_WETH finds none of it.
-    test.each([
-        {
-            kind: "an UNWRAP_WETH whose recipient cannot be read, then a WRAP_ETH of all the router's ETH to the user",
-            steps: [
-                withDirtyWord(unwrapWeth(ADDRESS_THIS), 0),
-                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
-            ],
-        },
-        {
-            kind: "an UNWRAP_WETH into the router, a WRAP_ETH of all its ETH to the user, then a WRAP_ETH of all its ETH into the router",
-            steps: [
-                unwrapWeth(ADDRESS_THIS),
-                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
-                wrapEth(ADDRESS_THIS, CONTRACT_BALANCE),
-            ],
-        },
-    ])(
-        "$kind, then an UNWRAP_WETH to the user, reads as WETH with no minimum",
-        ({ steps }) => {
-            const result = decode(
-                execute(
-                    swapToWeth(ADDRESS_THIS),
-                    ...steps,
-                    unwrapWeth(MSG_SENDER),
-                ),
-            );
-            expect(result.name).toBe("Swap USDT → WETH");
-            expect(detail(result, "Min. received")).toBeUndefined();
-            expect(detail(result, "Min. paid out")).toBeUndefined();
-        },
-    );
-
-    // A SWEEP of WETH pays out WETH, and ETH paid to a WETH contract pays the
-    // router WETH for it. The decoder treats each as a step that may pay out
-    // as WETH the swap's output, which the router holds as ETH.
-    test.each([
-        {
-            kind: "a SWEEP of WETH to the user",
-            step: sweep(WETH, MSG_SENDER),
-        },
-        {
-            kind: "a SWEEP of its ETH to the WETH contract",
-            step: sweep(ZERO, WETH),
-        },
-        {
-            kind: "a TRANSFER of 0.5 ETH to the WETH contract",
-            step: transfer(0x05, ZERO, WETH, ONE_WETH / 2n),
-        },
-        {
-            kind: "a PAY_PORTION of all its ETH to the WETH contract",
-            step: transfer(0x06, ZERO, WETH, 10000n),
-        },
-    ])(
-        "an UNWRAP_WETH into the router, then $kind, reads as WETH with no minimum",
-        ({ step }) => {
-            const result = decode(
-                execute(
-                    swapToWeth(ADDRESS_THIS),
-                    unwrapWeth(ADDRESS_THIS),
-                    step,
-                ),
-            );
-            expect(result.name).toBe("Swap USDT → WETH");
-            expect(detail(result, "Min. received")).toBeUndefined();
-            expect(detail(result, "Min. paid out")).toBeUndefined();
-        },
-    );
-
-    // The user receives 0.5 WETH and the rest of the swap's output as ETH.
-    test("an UNWRAP_WETH into the router, then a WRAP_ETH of 0.5 ETH to the user, reads as WETH with no minimum", () => {
-        const result = decode(
-            execute(
-                swapToWeth(ADDRESS_THIS),
-                unwrapWeth(ADDRESS_THIS),
-                wrapEth(MSG_SENDER, ONE_WETH / 2n),
-                sweep(ZERO, MSG_SENDER),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → WETH");
-        expect(labels(result)).toEqual(NO_MINIMUM_TO_USER);
-    });
-
-    // The UNWRAP_WETH pays the user the swap's WETH as ETH; the WRAP_ETH wraps
-    // the ETH an earlier V4 step paid the router.
-    test("an UNWRAP_WETH to the user, then a WRAP_ETH of all the router's ETH to the user, reads as ETH", () => {
-        const result = decode(
-            execute(
-                v4Swap(
-                    SWAP_USDT_FOR_ETH,
-                    SETTLE_USDT,
-                    take(ZERO, ADDRESS_THIS),
-                ),
-                swapToWeth(ADDRESS_THIS),
-                unwrapWeth(MSG_SENDER),
-                wrapEth(MSG_SENDER, CONTRACT_BALANCE),
-            ),
-        );
-        expect(detail(result, "Token Out").value).toBe("ETH");
-        expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
-    });
-
-    // The first swap is for at least 0.5 WETH and the second for at least
-    // 1 WETH. The second sets the output side again, so the first
-    // UNWRAP_WETH into the router no longer bears on it.
-    test.each([
-        { kind: "a V3 swap step", step: swapToWeth(ADDRESS_THIS) },
-        {
-            kind: "a V4 step that TAKEs its WETH to the router",
-            step: v4Swap(
-                SWAP_USDT_FOR_WETH,
-                SETTLE_USDT,
-                take(WETH, ADDRESS_THIS),
-            ),
-        },
-    ])(
-        "a swap paying WETH to the router, an UNWRAP_WETH into the router, a SWEEP of its ETH to the user, then $kind and an UNWRAP_WETH to the user, reads as ETH with the second swap's minimum",
-        ({ step }) => {
-            const result = decode(
-                execute(
-                    v3SwapExactIn(
-                        ADDRESS_THIS,
-                        USDT_2000,
-                        ONE_WETH / 2n,
-                        USDT,
-                        WETH,
-                    ),
-                    unwrapWeth(ADDRESS_THIS),
-                    sweep(ZERO, MSG_SENDER),
-                    step,
-                    unwrapWeth(MSG_SENDER),
-                ),
-            );
-            expect(result.name).toBe("Swap USDT → ETH");
-            expect(detail(result, "Min. received").value).toBe("1.0000 ETH");
-        },
-    );
-});
-
 // https://git.eeqj.de/sneak/AutistMask/issues/606: any token a step pays the
 // router stays there unless a later step pays out or spends all of it, not
 // only the swap's output. A V4 SETTLE can take more of the user's tokens than
@@ -1332,10 +783,6 @@ describe("any token left in the router is not received", () => {
                 ),
             ),
             left: tokenLine(WETH, "WETH"),
-            // The second swap action spends 1 USDC of what the first buys,
-            // so the step states no minimum
-            // (https://git.eeqj.de/sneak/AutistMask/issues/574).
-            noMin: true,
         },
         {
             kind: "a WRAP_ETH of 1 ETH into the router, then a V4 SETTLE of OPEN_DELTA from the router before the swap, which the user settles",
@@ -1436,24 +883,15 @@ describe("any token left in the router is not received", () => {
             ),
             left: { label: "Token moved into the router", value: "ETH" },
         },
-    ])("$kind", ({ data, left, spent, unread, noMin }) => {
+    ])("$kind", ({ data, left, spent, unread }) => {
         const result = decode(data);
         expect(labels(result)).toEqual([
             "Protocol",
             "Token In",
             // A later step whose SETTLE or SETTLE_ALL the decoder cannot read
             // may take anything from the sender: one line says so, in place
-            // of the Amount line (https://git.eeqj.de/sneak/AutistMask/issues/625),
-            // after the lines the WRAP_ETH's 1 ETH then gets
-            // (https://git.eeqj.de/sneak/AutistMask/issues/659).
-            ...(unread
-                ? [
-                      "Moved from the sender",
-                      "Token moved",
-                      "Moved to",
-                      "Moved from the sender",
-                  ]
-                : ["Amount"]),
+            // of the Amount line (https://git.eeqj.de/sneak/AutistMask/issues/625).
+            unread ? "Moved from the sender" : "Amount",
             // A later swap step the user pays for spends `spent` of a token
             // other than Token In.
             ...(spent
@@ -1462,7 +900,7 @@ describe("any token left in the router is not received", () => {
             "Token Out",
             "Paid to",
             "Token moved into the router",
-            ...(noMin ? [] : ["Min. paid out"]),
+            "Min. paid out",
             "Steps",
             "Deadline",
         ]);
@@ -1470,17 +908,13 @@ describe("any token left in the router is not received", () => {
             expect(detail(result, "Moved from the sender").value).toBe(spent);
         }
         if (unread) {
-            expect(
-                result.details
-                    .filter((d) => d.label === "Moved from the sender")
-                    .map((d) => d.value),
-            ).toEqual(["1.0000 ETH", UNDECODED]);
+            expect(detail(result, "Moved from the sender").value).toBe(
+                UNDECODED,
+            );
         }
         expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
         expect(detail(result, "Token moved into the router")).toEqual(left);
-        expect(detail(result, "Min. paid out")?.value).toBe(
-            noMin ? undefined : "1990.0000 USDC",
-        );
+        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
     });
 
     // Uniswap's own routes: a swap paid in ETH wraps into the router what its
@@ -2088,6 +1522,15 @@ describe("a payout of part of the router's output", () => {
             ),
             min: "1.0000 WETH",
         },
+        {
+            kind: "PAY_PORTION of 25 bips, then UNWRAP_WETH",
+            data: execute(
+                swapToWeth(ADDRESS_THIS),
+                transfer(0x06, WETH, OTHER, 25n),
+                unwrapWeth(MSG_SENDER),
+            ),
+            min: "1.0000 ETH",
+        },
         {
             kind: "V4 TAKE_PORTION of 25 bips, then TAKE_ALL",
             data: execute(
@@ -2576,6 +2019,10 @@ describe("a payout that cannot be read is never said to be received", () => {
                 ),
             ],
         },
+        {
+            kind: "V3_SWAP_EXACT_OUT",
+            step: [0x01, swapToWeth(OTHER)[1]],
+        },
         {
             kind: "EXECUTE_SUB_PLAN",
             step: [
@@ -2808,37 +2255,26 @@ describe("the allow-revert flag", () => {
     });
 
     // Only the routers from UniversalRouterV2 on let a PERMIT2_PERMIT fail.
-    // The permit's spender is the router at ROUTER, which on every other
-    // router is an allowance to another spender, so the minimum reads
-    // Min. paid out there.
     test.each([
-        {
-            router: "UniversalRouterV1",
-            address: ROUTER_V1,
-            mark: "",
-            minimum: "Min. paid out",
-        },
+        { router: "UniversalRouterV1", address: ROUTER_V1, mark: "" },
         {
             router: "UniversalRouterV1_2_V2Support",
             address: ROUTER_V1_2,
             mark: "",
-            minimum: "Min. paid out",
         },
         {
             router: "UniversalRouterV2",
             address: ROUTER,
             mark: " (allowed to fail)",
-            minimum: "Min. received",
         },
         {
             router: "UniversalRouterV2_1_2",
             address: ROUTER_V2_1_2,
             mark: " (allowed to fail)",
-            minimum: "Min. paid out",
         },
     ])(
-        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap's lines read as without the flag",
-        ({ address, mark, minimum }) => {
+        "on $router, a PERMIT2_PERMIT with the flag is listed as 'Permit2 Permit$mark', and the swap reads as without the flag",
+        ({ address, mark }) => {
             const steps = [
                 permit2Permit(USDT, USDT_2000),
                 swapToWeth(MSG_SENDER),
@@ -2852,25 +2288,10 @@ describe("the allow-revert flag", () => {
             expect(detail(withFlag, "Steps").value).toBe(
                 "Permit2 Permit" + mark + " → V3 Swap (Exact In)",
             );
-            // The permit names the router at ROUTER as its spender, so its
-            // amount stands as the Amount figure only there, and only without
-            // the flag. With the flag it stands on no router and gets lines
-            // of its own, and the swap step names Token In: the same token,
-            // its address written the same way.
-            const permitLines = [
-                "Permit2 allowance",
-                "Allowance token",
-                "Allowance spender",
-            ];
-            const swapLines = (r) =>
-                r.details.filter(
-                    (d) => !["Steps", ...permitLines].includes(d.label),
-                );
-            expect(swapLines(withFlag)).toEqual(swapLines(plain));
-            expect(
-                labels(withFlag).filter((l) => permitLines.includes(l)),
-            ).toEqual(permitLines);
-            expect(detail(withFlag, minimum).value).toBe("1.0000 WETH");
+            const withoutSteps = (r) =>
+                r.details.filter((d) => d.label !== "Steps");
+            expect(withoutSteps(withFlag)).toEqual(withoutSteps(plain));
+            expect(detail(withFlag, "Min. received").value).toBe("1.0000 WETH");
         },
     );
 

tests/uniswapRouterAddress.test.js

@@ -7,12 +7,6 @@
 // only when the transaction is sent to a Universal Router deployment on the
 // network it is for; anywhere else it is left to the raw data.
 //
-// The transaction history labelled any call named `execute` or `multicall` a
-// Swap, whatever address it went to
-// (https://git.eeqj.de/sneak/AutistMask/issues/580). It now does so only for
-// such a call sent to a Universal Router deployment on the network the
-// transaction is on; any other is labelled by its method name.
-//
 // The transaction detail screen and the approval screen are driven against a
 // minimal DOM stub in the shape tests/tokenTransferDetail.test.js uses, the
 // approval screen opened the way tests/swapStatusAmount.test.js opens it.
@@ -39,7 +33,6 @@ globalThis.chrome = {
 };
 
 const { state } = require("../src/shared/state");
-const { fetchRecentTransactions } = require("../src/shared/transactions");
 const approval = require("../src/popup/views/approval");
 const { decodeCalldata } = approval;
 const transactionDetail = require("../src/popup/views/transactionDetail");
@@ -54,8 +47,6 @@ const SEPOLIA_ROUTER = "0x3a9d48ab9751398bbfa63ad67599bb04e4bdf98b";
 const ROUTER_ON_BOTH = "0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD";
 // The address with no code from the issue.
 const ORDINARY = "0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A";
-// A contract that is not a router, such as a multisig.
-const OTHER_CONTRACT = "0x5afe000000000000000000000000000000005afe";
 
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const SEPOLIA_WETH = "0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14";
@@ -138,13 +129,8 @@ describe("execute() calldata on the approval screen's decoder", () => {
 // The transaction the explorer reports: SWAP_DATA, sent to `mockSentTo`.
 const TX_HASH = "0x" + "5".repeat(64);
 let mockSentTo = null;
-// The transactions the explorer reports for RECIPIENT's history.
-let mockHistory = [];
 
 function mockExplorerAnswer(url) {
-    if (url.endsWith("/addresses/" + RECIPIENT + "/transactions")) {
-        return { items: mockHistory };
-    }
     if (url.endsWith("/transactions/" + TX_HASH)) {
         return {
             to: { hash: mockSentTo },
@@ -201,9 +187,10 @@ function node(id) {
 }
 
 // Open the transaction detail screen with `activeNetworkId` active, for the
-// history row `row`, and wait for its decoded details.
-async function showDetail(row, activeNetworkId) {
-    mockSentTo = row.to;
+// Sepolia transaction the explorer reports sent to `sentTo`, and wait for its
+// decoded details.
+async function showDetailSentTo(sentTo, activeNetworkId) {
+    mockSentTo = sentTo;
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" } };
     state.networkId = activeNetworkId;
@@ -211,32 +198,22 @@ async function showDetail(row, activeNetworkId) {
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;
-    transactionDetail.show(row);
+    transactionDetail.show({
+        hash: TX_HASH,
+        from: RECIPIENT,
+        to: sentTo,
+        value: "",
+        symbol: "SepoliaETH",
+        timestamp: 1790000000,
+        isError: false,
+        direction: "contract",
+        directionLabel: "Swap",
+        method: "execute",
+        chainId: SEPOLIA,
+    });
     for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
-// Open the transaction detail screen with `activeNetworkId` active, for the
-// Sepolia transaction the explorer reports sent to `sentTo`, and wait for its
-// decoded details.
-async function showDetailSentTo(sentTo, activeNetworkId) {
-    await showDetail(
-        {
-            hash: TX_HASH,
-            from: RECIPIENT,
-            to: sentTo,
-            value: "",
-            symbol: "SepoliaETH",
-            timestamp: 1790000000,
-            isError: false,
-            direction: "contract",
-            directionLabel: "Swap",
-            method: "execute",
-            chainId: SEPOLIA,
-        },
-        activeNetworkId,
-    );
-}
-
 describe("execute() calldata on the transaction detail screen", () => {
     test("sent to a router on the active network, it is a swap", async () => {
         await showDetailSentTo(SEPOLIA_ROUTER, "sepolia");
@@ -268,58 +245,6 @@ describe("execute() calldata on the transaction detail screen", () => {
     });
 });
 
-// The history row made from the explorer's answer for RECIPIENT's `method`
-// call sent to the contract `sentTo` on the network with `chainId`. The
-// explorer gives the address in checksummed form.
-async function historyRow(method, sentTo, chainId) {
-    mockHistory = [
-        {
-            hash: TX_HASH,
-            block_number: 7000000,
-            timestamp: "2026-09-01T00:00:00Z",
-            from: { hash: RECIPIENT },
-            to: { hash: getAddress(sentTo), is_contract: true },
-            value: "0",
-            method,
-            status: "ok",
-        },
-    ];
-    const rows = await fetchRecentTransactions(
-        RECIPIENT,
-        "https://explorer.example/api/v2",
-        chainId,
-    );
-    return rows[0];
-}
-
-// The history row's label and TransactionDetail's Type line, for a Sepolia
-// transaction. The active network does not decide either.
-describe.each([
-    ["execute", "Execute"],
-    ["multicall", "Multicall"],
-])("a %s() call in the history", (method, methodLabel) => {
-    test("sent to a router on its network, it is a Swap", async () => {
-        const row = await historyRow(method, SEPOLIA_ROUTER, SEPOLIA);
-        expect(row.directionLabel).toBe("Swap");
-        await showDetail(row, "mainnet");
-        expect(node("tx-detail-type").textContent).toBe("Swap");
-    });
-
-    test("sent to another contract, it is labelled by its method name", async () => {
-        const row = await historyRow(method, OTHER_CONTRACT, SEPOLIA);
-        expect(row.directionLabel).toBe(methodLabel);
-        await showDetail(row, "sepolia");
-        expect(node("tx-detail-type").textContent).toBe("Contract Call");
-    });
-
-    test("sent to a router of the other network only, it is labelled by its method name", async () => {
-        const row = await historyRow(method, MAINNET_ROUTER, SEPOLIA);
-        expect(row.directionLabel).toBe(methodLabel);
-        await showDetail(row, "mainnet");
-        expect(node("tx-detail-type").textContent).toBe("Contract Call");
-    });
-});
-
 // Open the approval screen with Ethereum Mainnet active, for a site's Sepolia
 // transaction that sends SWAP_DATA to `sentTo`.
 async function showApprovalSentTo(sentTo) {

tests/unknownScaleSend.test.js

@@ -120,7 +120,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator.clipboard = { writeText() {} };
+global.navigator = { clipboard: { writeText() {} } };
 
 const { AbiCoder, parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");

tests/walletDefects.test.js

@@ -475,7 +475,7 @@ describe("every way to a signature or the private key refuses a defective wallet
                 to: RECIPIENT,
                 value: "0x0",
                 data: "0x",
-                chainId: "0x1",
+                chainId: 1,
                 nonce: 0,
                 gasLimit: "21000",
                 maxFeePerGas: "1000000000",