@formo/analytics 1.38.0 → 1.38.2

package/dist/esm/src/evm/EvmEventTracker.js

@@ -136,10 +136,54 @@ var EvmEventTracker = /** @class */ (function () {
          * Announcement-driven cleanup must not touch them: they are never in an
          * announcement list, so "missing from the announcement" is their normal
          * state, not evidence of removal. A Set rather than a WeakSet because
-         * suppressed adoptions retry from it; the registry holds these providers
-         * strongly anyway, and untrack removes them.
+         * the corrected-detect pass iterates it; the registry's detail list
+         * holds these providers strongly for the instance's life anyway.
          */
         this.externallyRegistered = new Set();
+        /**
+         * Registered providers whose session this SDK has NOT yet learned.
+         *
+         * Only these are retried on page hits and opt-in. Re-running adoption for
+         * every registered provider looked idempotent but was not: adoption is
+         * the same path a live `accountsChanged` takes, and that path treats a
+         * provider with a different address from the active one as a wallet
+         * switch. With two registered providers, or one registered next to a
+         * discovered wallet, every page hit emitted a disconnect and a connect
+         * that no user action caused.
+         *
+         * A provider enters at registration (it may have no session yet, or be
+         * refused because tracking is suppressed), again whenever a handler
+         * refuses its signal while suppressed (noted on entry AND at the
+         * suppressed commit, since the handlers gate on the active provider and
+         * re-check suppression after an await), and again for all of them when
+         * an opt-out purges identity. It leaves the first time a handler commits
+         * its session unsuppressed, or when it is untracked. Retrying reads the
+         * provider's SYNCHRONOUS accounts only - no RPC - so a registered
+         * provider whose session never fires `accountsChanged` (a wallet that
+         * signals `connect` alone while `autocapture.connect` is off, which
+         * installs a chain-only observer) is still adopted on the next hit. "No
+         * RPC" holds for the pending provider itself; the handler's switch
+         * arbitration may still ask the ACTIVE provider for its accounts, as it
+         * does for any live signal.
+         *
+         * Replay goes through the accounts handler, which has live wallet-switch
+         * semantics: a different provider with a different address is a switch.
+         * So a pending provider is replayed only while no OTHER wallet is active
+         * and known - it waits, at no cost, until that wallet is gone - unless
+         * its own signal was refused (`latestRefused`): then the replay does
+         * exactly what the live signal would have done, switch included.
+         */
+        this.pendingAdoptions = new Set();
+        /**
+         * Registered providers whose session ended and have not signalled a
+         * new one. Some providers keep stale synchronous `accounts` after a
+         * disconnect; replaying those would re-install a session that is over.
+         * Any later session signal (connect, accountsChanged) lifts this.
+         */
+        this.awaitingNewSession = new Set();
+        /** One retry scan at a time; a call during a scan queues one more. */
+        this.retryInFlight = false;
+        this.retryRequested = false;
         /**
          * The connect this SDK has already reported for a provider.
          *
@@ -148,10 +192,89 @@ var EvmEventTracker = /** @class */ (function () {
          * which is when a record must lapse.
          */
         this._announcedConnect = new WeakMap();
+        /** Set by `cleanup()`; every awaited continuation checks it. */
+        this.disposed = false;
+        /** Bumped when a registered provider's session ends. See reopenAdoption. */
+        this.sessionGenerations = new WeakMap();
     }
+    EvmEventTracker.prototype.dropRefusal = function (provider) {
+        if (this.latestRefused === provider)
+            this.latestRefused = undefined;
+    };
+    /**
+     * An opt-out purges wallet identity. Every registered session is then
+     * unknown again (pending; no refusal is ADDED, so the opt-in replay of a
+     * merely connected wallet does not switch, while a refusal already
+     * standing from an excluded route keeps its meaning), and the
+     * opt-in retry must re-learn all of them: with the active wallet's
+     * address gone, the accounts handler cannot even tell a second wallet's
+     * accounts apart from the active one's, and would ignore them.
+     */
+    EvmEventTracker.prototype.markRegisteredAdoptionsPending = function () {
+        var _this = this;
+        this.externallyRegistered.forEach(function (provider) {
+            return _this.pendingAdoptions.add(provider);
+        });
+    };
+    /**
+     * Remember a registered provider's signal that suppression refuses.
+     *
+     * Replay privilege (`latestRefused`) goes only to a provider whose
+     * session the replay can actually read - synchronous accounts - so an
+     * accountless `connect` (a chain-only observation, or a session still
+     * pairing) cannot displace an earlier refusal that is adoptable.
+     */
+    EvmEventTracker.prototype.noteRefusalIfSuppressed = function (provider) {
+        if (this.deps.isTrackingSuppressed() &&
+            this.externallyRegistered.has(provider)) {
+            this.pendingAdoptions.add(provider);
+            var adoptable = false;
+            try {
+                adoptable = readProviderAccounts(provider).length > 0;
+            }
+            catch (_a) {
+                /* unreadable state: pending, not privileged */
+            }
+            if (adoptable)
+                this.latestRefused = provider;
+        }
+    };
+    /** A handler has learned this provider's session; nothing is pending. */
+    EvmEventTracker.prototype.settleAdoption = function (provider) {
+        this.pendingAdoptions.delete(provider);
+        this.awaitingNewSession.delete(provider);
+        this.dropRefusal(provider);
+    };
+    /**
+     * A registered provider's session has ended. Its NEXT session is not
+     * yet learned, and may announce itself in a way no handler adopts (a
+     * `connect` alone while `autocapture.connect` is off installs a
+     * chain-only observer), so it is pending again for the page-hit retry.
+     */
+    EvmEventTracker.prototype.reopenAdoption = function (provider) {
+        var _a;
+        if (this.externallyRegistered.has(provider)) {
+            this.pendingAdoptions.add(provider);
+            this.awaitingNewSession.add(provider);
+            // A lookup still in flight for the session that just ended must not
+            // record a refusal for it when it resolves.
+            this.sessionGenerations.set(provider, ((_a = this.sessionGenerations.get(provider)) !== null && _a !== void 0 ? _a : 0) + 1);
+            // The refusal marker described the session that just ended. Left
+            // standing, a later connect-only session would inherit it and be
+            // replayed as a switch away from another active wallet.
+            this.dropRefusal(provider);
+        }
+    };
     /** Stop listening for wallet announcements. Called from SDK teardown. */
     EvmEventTracker.prototype.cleanup = function () {
         var _a;
+        // A replay in flight (awaiting the active wallet's accounts) must not
+        // resume into a torn-down instance and commit a session there.
+        this.disposed = true;
+        this.pendingAdoptions.clear();
+        this.awaitingNewSession.clear();
+        this.latestRefused = undefined;
+        this.retryRequested = false;
         try {
             (_a = this.unsubscribeDiscovery) === null || _a === void 0 ? void 0 : _a.call(this);
         }
@@ -160,6 +283,10 @@ var EvmEventTracker = /** @class */ (function () {
         }
         this.unsubscribeDiscovery = undefined;
     };
+    EvmEventTracker.prototype.sessionGeneration = function (provider) {
+        var _a;
+        return (_a = this.sessionGenerations.get(provider)) !== null && _a !== void 0 ? _a : 0;
+    };
     /** Drop a provider's reported connect. Called when it stops being active. */
     EvmEventTracker.prototype.forgetAnnouncedConnect = function (provider) {
         this._announcedConnect.delete(provider);
@@ -321,6 +448,9 @@ var EvmEventTracker = /** @class */ (function () {
         void this.detectWallets([
             __assign(__assign({}, detail), { info: __assign(__assign({}, detail.info), this.registry.infoFor(provider)) }),
         ]);
+        // Pending until a handler commits its session unsuppressed: the
+        // session may not exist yet, or adoption may be refused right below.
+        this.pendingAdoptions.add(provider);
         var accounts = readProviderAccounts(provider);
         if (accounts.length > 0) {
             void this.onAccountsChanged(provider, accounts);
@@ -328,14 +458,19 @@ var EvmEventTracker = /** @class */ (function () {
         return true;
     };
     /**
-     * Re-run session adoption for every registered external provider.
+     * Finish what registration could not.
+     *
+     * A registered provider's session may not have existed at registration,
+     * or its adoption was refused because tracking was suppressed (opt-out,
+     * excluded route) - and an existing session may never emit another
+     * accountsChanged, so nothing else would ever retry. Called when
+     * suppression can have ended (opt-in, page navigation).
      *
-     * Registration while tracking was suppressed (opt-out, excluded route)
-     * reached the adoption path and was refused - and a provider whose
-     * session already exists may never emit another accountsChanged, so
-     * nothing would ever retry. Called when suppression can have ended
-     * (opt-in, page navigation). Idempotent: an already-adopted wallet is
-     * deduplicated by the same state and markers as any repeated signal.
+     * Adoption is retried ONLY for providers not yet adopted
+     * (`pendingAdoptions`), only from their synchronous accounts, and only
+     * once suppression has actually ended. The corrected-detect pass below
+     * runs for every registered provider: it is deduplicated per session by
+     * rdns, so repeating it is free.
      */
     EvmEventTracker.prototype.retryExternalAdoptions = function () {
         var _this = this;
@@ -358,11 +493,97 @@ var EvmEventTracker = /** @class */ (function () {
                     },
                 ]);
             }
-            var accounts = readProviderAccounts(provider);
-            if (accounts.length > 0) {
-                void _this.onAccountsChanged(provider, accounts);
-            }
         });
+        if (this.disposed ||
+            this.pendingAdoptions.size === 0 ||
+            this.deps.isTrackingSuppressed()) {
+            // Nothing to finish, or still suppressed: adopting now would be
+            // refused again, and the entry must survive for the next chance.
+            return;
+        }
+        // ONE scan at a time, providers awaited in turn, and the entry is NOT
+        // removed here: only a handler that commits the session removes it.
+        // Fired concurrently - two overlapping scans from repeated page hits,
+        // or two providers within one - the later call made the earlier
+        // one's observation stale; a stale return dropped a provider whose
+        // session was never learned, and a second scan replayed a provider
+        // the first was still switching to, emitting the old wallet's
+        // disconnect twice. A call that lands during a scan queues exactly
+        // one more scan, so nothing that changed meanwhile is missed.
+        if (this.retryInFlight) {
+            this.retryRequested = true;
+            return;
+        }
+        this.retryInFlight = true;
+        void (function () { return __awaiter(_this, void 0, void 0, function () {
+            var first, ordered, _i, ordered_1, provider, accounts, otherWalletActive, _a;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _b.trys.push([0, , 9, 10]);
+                        _b.label = 1;
+                    case 1:
+                        this.retryRequested = false;
+                        first = [this.wallet.provider, this.latestRefused].filter(function (p) { return !!p && _this.pendingAdoptions.has(p); });
+                        ordered = Array.from(new Set(__spreadArray(__spreadArray([], first, true), Array.from(this.pendingAdoptions), true)));
+                        _i = 0, ordered_1 = ordered;
+                        _b.label = 2;
+                    case 2:
+                        if (!(_i < ordered_1.length)) return [3 /*break*/, 7];
+                        provider = ordered_1[_i];
+                        if (this.disposed || this.deps.isTrackingSuppressed())
+                            return [3 /*break*/, 7];
+                        accounts = void 0;
+                        try {
+                            accounts = readProviderAccounts(provider);
+                        }
+                        catch (_c) {
+                            // A wallet whose state getters throw (transport disposed)
+                            // stays pending; it must not abort the scan for the others,
+                            // nor surface as an unhandled rejection from this task.
+                            return [3 /*break*/, 6];
+                        }
+                        if (accounts.length === 0 || this.awaitingNewSession.has(provider)) {
+                            // No session yet, or none since the last one ended: stays
+                            // pending, at no cost.
+                            return [3 /*break*/, 6];
+                        }
+                        otherWalletActive = this.wallet.provider !== undefined &&
+                            this.wallet.provider !== provider;
+                        if (otherWalletActive && this.latestRefused !== provider) {
+                            // Never signalled, merely connected: replaying it now would
+                            // be reported as a wallet switch nobody made. Waits for
+                            // that wallet to go.
+                            return [3 /*break*/, 6];
+                        }
+                        _b.label = 3;
+                    case 3:
+                        _b.trys.push([3, 5, , 6]);
+                        return [4 /*yield*/, this.onAccountsChanged(provider, accounts)];
+                    case 4:
+                        _b.sent();
+                        return [3 /*break*/, 6];
+                    case 5:
+                        _a = _b.sent();
+                        return [3 /*break*/, 6];
+                    case 6:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 7:
+                        if (this.retryRequested &&
+                            !this.disposed &&
+                            !this.deps.isTrackingSuppressed()) return [3 /*break*/, 1];
+                        _b.label = 8;
+                    case 8: return [3 /*break*/, 10];
+                    case 9:
+                        this.retryInFlight = false;
+                        this.retryRequested = false;
+                        return [7 /*endfinally*/];
+                    case 10: return [2 /*return*/];
+                }
+            });
+        }); })();
     };
     EvmEventTracker.prototype.registerAccountsChangedListener = function (provider) {
         var _this = this;
@@ -383,6 +604,11 @@ var EvmEventTracker = /** @class */ (function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        // A listener that could not be removed at cleanup (its provider's
+                        // removeListener threw) still fires; it must not touch a torn-down
+                        // instance.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         logger.info("onAccountsChanged", accounts);
                         claims = accounts.length > 0 || this.wallet.provider === provider;
                         observation = claims
@@ -418,11 +644,12 @@ var EvmEventTracker = /** @class */ (function () {
      */
     EvmEventTracker.prototype._handleAccountsChanged = function (provider, accounts, observation) {
         return __awaiter(this, void 0, void 0, function () {
-            var error_1, address, currentStoredAddress, newProviderAddress, activeProviderAccounts, error_2, nextChainId, wasDisconnected, providerInfo, effectiveChainId;
+            var error_1, address, session, currentStoredAddress, newProviderAddress, activeProviderAccounts, error_2, nextChainId, wasDisconnected, providerInfo, effectiveChainId;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         if (!(accounts.length === 0)) return [3 /*break*/, 9];
+                        this.reopenAdoption(provider);
                         if (!(this.wallet.provider === provider)) return [3 /*break*/, 7];
                         logger.info("OnAccountsChanged: Detecting disconnect, current state:", {
                             evmAddress: this.wallet.evmAddress,
@@ -445,6 +672,9 @@ var EvmEventTracker = /** @class */ (function () {
                     case 2:
                         // Pass EVM state explicitly to ensure we have the data for the disconnect event
                         _a.sent();
+                        // Torn down during the emission: nothing below may run.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         return [3 /*break*/, 4];
                     case 3:
                         error_1 = _a.sent();
@@ -469,6 +699,12 @@ var EvmEventTracker = /** @class */ (function () {
                             logger.warn("onAccountsChanged: Invalid address received", accounts[0]);
                             return [2 /*return*/];
                         }
+                        // Before the active-provider gates below: a registered provider that
+                        // is not the active one can return early without ever reaching the
+                        // suppressed commit, and its session may never signal again.
+                        this.awaitingNewSession.delete(provider);
+                        this.noteRefusalIfSuppressed(provider);
+                        session = this.sessionGeneration(provider);
                         if (!(this.wallet.provider && this.wallet.provider !== provider)) return [3 /*break*/, 26];
                         currentStoredAddress = this.wallet.evmAddress;
                         newProviderAddress = validateAndChecksumAddress(address);
@@ -484,12 +720,24 @@ var EvmEventTracker = /** @class */ (function () {
                         return [4 /*yield*/, this.registry.accountsOf(this.wallet.provider)];
                     case 11:
                         activeProviderAccounts = _a.sent();
+                        if (this.disposed)
+                            return [2 /*return*/];
+                        if (this.sessionGeneration(provider) !== session) {
+                            // This provider's session ended during the probe: the signal
+                            // describes nothing that still exists, refusal included.
+                            this.dropRefusal(provider);
+                            return [2 /*return*/];
+                        }
                         // The probe is asynchronous too, so check before issuing anything.
                         // Every branch below reads the CURRENT evm state, so a switch that
                         // went stale during the probe would emit a false disconnect for
                         // whoever claimed the namespace, and clear them.
-                        if (!this.wallet.isCurrent(observation))
+                        if (!this.wallet.isCurrent(observation)) {
+                            // Superseded: this signal's refusal, if noted, no longer describes
+                            // a session the replay may switch to.
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
+                        }
                         logger.info("OnAccountsChanged: Checking current provider accounts", {
                             activeProvider: this.registry.infoFor(this.wallet.provider).name,
                             accountsLength: activeProviderAccounts
@@ -515,6 +763,9 @@ var EvmEventTracker = /** @class */ (function () {
                             })];
                     case 12:
                         _a.sent();
+                        // Torn down during the emission: nothing below may run.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         return [3 /*break*/, 14];
                     case 13:
                         logger.debug("OnAccountsChanged: Disconnect event skipped during provider switch (autocapture.disconnect: false)");
@@ -522,12 +773,31 @@ var EvmEventTracker = /** @class */ (function () {
                         this.wallet.clear('evm');
                         _a.label = 14;
                     case 14:
-                        if (!this.wallet.isCurrent(observation))
+                        if (!this.wallet.isCurrent(observation)) {
+                            // Superseded: this signal's refusal, if noted, no longer describes
+                            // a session the replay may switch to.
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
+                        }
                         // Clear state and let the new provider become active
                         this.wallet.clearProvider();
                         return [3 /*break*/, 16];
                     case 15:
+                        // Ignored: the active wallet has accounts and this signal's
+                        // address is the same, or the active address is unknown (a
+                        // discovered wallet whose identity an opt-out purged; a
+                        // registered one is re-learned before this point). THIS
+                        // provider's session is not adopted; it stays pending without
+                        // its refusal marker, so it is not probed again on every page
+                        // hit while the active wallet stands, and is adopted once that
+                        // wallet is gone. A live signal is ignored here in exactly the
+                        // same way, so the replay changes nothing about who is active.
+                        // While SUPPRESSED this is the refusal itself, not a verdict:
+                        // the marker stands for the replay that runs once suppression
+                        // ends.
+                        if (!this.deps.isTrackingSuppressed()) {
+                            this.dropRefusal(provider);
+                        }
                         logger.info("OnAccountsChanged: Current provider still has accounts and same address, ignoring new provider", {
                             activeProvider: this.registry.infoFor(this.wallet.provider).name,
                             eventProvider: this.registry.infoFor(provider).name,
@@ -550,6 +820,9 @@ var EvmEventTracker = /** @class */ (function () {
                             })];
                     case 18:
                         _a.sent();
+                        // Torn down during the emission: nothing below may run.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         return [3 /*break*/, 20];
                     case 19:
                         logger.debug("OnAccountsChanged: Disconnect event skipped for old provider (autocapture.disconnect: false)");
@@ -557,8 +830,12 @@ var EvmEventTracker = /** @class */ (function () {
                         this.wallet.clear('evm');
                         _a.label = 20;
                     case 20:
-                        if (!this.wallet.isCurrent(observation))
+                        if (!this.wallet.isCurrent(observation)) {
+                            // Superseded: this signal's refusal, if noted, no longer describes
+                            // a session the replay may switch to.
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
+                        }
                         _a.label = 21;
                     case 21: return [3 /*break*/, 26];
                     case 22:
@@ -579,6 +856,9 @@ var EvmEventTracker = /** @class */ (function () {
                             })];
                     case 23:
                         _a.sent();
+                        // Torn down during the emission: nothing below may run.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         return [3 /*break*/, 25];
                     case 24:
                         logger.debug("OnAccountsChanged: Disconnect event skipped for failed provider check (autocapture.disconnect: false)");
@@ -586,8 +866,12 @@ var EvmEventTracker = /** @class */ (function () {
                         this.wallet.clear('evm');
                         _a.label = 25;
                     case 25:
-                        if (!this.wallet.isCurrent(observation))
+                        if (!this.wallet.isCurrent(observation)) {
+                            // Superseded: this signal's refusal, if noted, no longer describes
+                            // a session the replay may switch to.
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
+                        }
                         return [3 /*break*/, 26];
                     case 26:
                         // Set provider if none exists (first connection)
@@ -596,6 +880,8 @@ var EvmEventTracker = /** @class */ (function () {
                         }
                         // If both the provider and address are the same, no-op
                         if (this.wallet.provider === provider && address === this.wallet.evmAddress) {
+                            // This session is the one already known; nothing is pending for it.
+                            this.settleAdoption(provider);
                             return [2 /*return*/];
                         }
                         nextChainId = this.registry.resolveChainId(provider);
@@ -606,9 +892,14 @@ var EvmEventTracker = /** @class */ (function () {
                         // events.)
                         if (this.deps.isTrackingSuppressed()) {
                             this.wallet.clearStaleEvmWalletOnSwitchWhileSuppressed(address);
+                            // Again after the await: suppression may have begun mid-flight.
+                            this.noteRefusalIfSuppressed(provider);
                         }
                         else {
                             this.wallet.set('evm', { address: address, chainId: nextChainId });
+                            // Adopted unsuppressed, whichever path got here first: a retry for
+                            // this provider would now be a repeat, not a completion.
+                            this.settleAdoption(provider);
                         }
                         providerInfo = this.registry.infoFor(provider);
                         effectiveChainId = nextChainId || 0;
@@ -667,6 +958,11 @@ var EvmEventTracker = /** @class */ (function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        // A listener that could not be removed at cleanup (its provider's
+                        // removeListener threw) still fires; it must not touch a torn-down
+                        // instance.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         logger.info("onChainChanged", chainIdHex);
                         nextChainId = parseChainId(chainIdHex);
                         // Record it for THIS provider regardless of which one is active. This is
@@ -767,9 +1063,16 @@ var EvmEventTracker = /** @class */ (function () {
                 args[_i] = arguments[_i];
             }
             var connection = args[0];
+            if (_this.disposed)
+                return;
             if (typeof (connection === null || connection === void 0 ? void 0 : connection.chainId) !== "string")
                 return;
             _this.registry.rememberChain(provider, parseChainId(connection.chainId));
+            _this.awaitingNewSession.delete(provider);
+            // This observer adopts nothing, but a registered provider's connect
+            // refused by suppression is still a refused signal: once suppression
+            // ends, its replay may switch, as the full handler's would.
+            _this.noteRefusalIfSuppressed(provider);
         };
         provider.on("connect", listener);
         this.registry.addListener(provider, "connect", listener);
@@ -828,6 +1131,9 @@ var EvmEventTracker = /** @class */ (function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        if (this.disposed)
+                            return [2 /*return*/];
+                        this.reopenAdoption(provider);
                         if (this.wallet.provider !== provider)
                             return [2 /*return*/];
                         // As in the accountsChanged disconnect path: the reported connect ends
@@ -849,6 +1155,9 @@ var EvmEventTracker = /** @class */ (function () {
                     case 2:
                         // Pass current state explicitly to ensure we have the data for the disconnect event
                         _a.sent();
+                        // Torn down during the emission: nothing below may run.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         return [3 /*break*/, 4];
                     case 3:
                         e_1 = _a.sent();
@@ -870,11 +1179,20 @@ var EvmEventTracker = /** @class */ (function () {
     };
     EvmEventTracker.prototype.onConnected = function (provider, connection) {
         return __awaiter(this, void 0, void 0, function () {
-            var disconnectsBefore, stateTicket, chainId, address, committed, movedElsewhere, wasDisconnected, isActiveProvider, providerInfo, effectiveChainId, providerInfo, e_2;
+            var disconnectsBefore, stateTicket, chainId, session, address, committed, movedElsewhere, wasDisconnected, isActiveProvider, providerInfo, effectiveChainId, providerInfo, e_2;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        // A listener that could not be removed at cleanup (its provider's
+                        // removeListener threw) still fires; it must not touch a torn-down
+                        // instance.
+                        if (this.disposed)
+                            return [2 /*return*/];
                         logger.info("onConnected", connection);
+                        // A session signal, and BEFORE the account lookup below: suppression
+                        // that ends while the lookup is in flight must not lose the refusal.
+                        this.awaitingNewSession.delete(provider);
+                        this.noteRefusalIfSuppressed(provider);
                         disconnectsBefore = this.wallet.disconnectsSoFar("evm");
                         stateTicket = this.wallet.currentObservation("evm");
                         _a.label = 1;
@@ -885,9 +1203,18 @@ var EvmEventTracker = /** @class */ (function () {
                         chainId = parseChainId(connection.chainId);
                         // Record it for this provider before anything can bail out below.
                         this.registry.rememberChain(provider, chainId);
+                        session = this.sessionGeneration(provider);
                         return [4 /*yield*/, this.registry.addressOf(provider)];
                     case 2:
                         address = _a.sent();
+                        if (this.disposed)
+                            return [2 /*return*/];
+                        if (this.sessionGeneration(provider) !== session) {
+                            // Disconnected while the lookup was in flight: a former account
+                            // arriving now must not record a refusal for an ended session.
+                            this.dropRefusal(provider);
+                            return [2 /*return*/];
+                        }
                         // A newer signal arrived while we were resolving the address. Claiming
                         // the namespace now would write this stale view over it, and would make
                         // a disconnect still in flight look stale so it skipped its cleanup. A
@@ -895,6 +1222,7 @@ var EvmEventTracker = /** @class */ (function () {
                         // is reported normally.
                         if (this.wallet.disconnectsSoFar("evm") !== disconnectsBefore) {
                             logger.info("onConnected: The wallet disconnected after this observation began; dropping it");
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
                         }
                         committed = this.wallet.evmAddress;
@@ -905,10 +1233,15 @@ var EvmEventTracker = /** @class */ (function () {
                             !this.wallet.isCurrent(stateTicket) &&
                             movedElsewhere) {
                             logger.info("onConnected: A newer signal from this provider has overtaken this connect observation; dropping it");
+                            this.dropRefusal(provider);
                             return [2 /*return*/];
                         }
                         if (chainId && address) {
                             wasDisconnected = !this.wallet.evmAddress;
+                            // Same refusal as the accounts path, and before the active-provider
+                            // gate: a registered provider that connects while another one is
+                            // active is not adopted here, and may never signal again.
+                            this.noteRefusalIfSuppressed(provider);
                             // Set provider if none exists
                             if (!this.wallet.provider) {
                                 this.wallet.provider = provider;
@@ -920,12 +1253,15 @@ var EvmEventTracker = /** @class */ (function () {
                             if (isActiveProvider) {
                                 if (this.deps.isTrackingSuppressed()) {
                                     this.wallet.clearStaleEvmWalletOnSwitchWhileSuppressed(address);
+                                    // Again after the await: suppression may have begun mid-flight.
+                                    this.noteRefusalIfSuppressed(provider);
                                 }
                                 else {
                                     this.wallet.set('evm', {
                                         chainId: chainId,
                                         address: validateAndChecksumAddress(address) || undefined,
                                     });
+                                    this.settleAdoption(provider);
                                 }
                             }
                             // Conditionally emit connect event based on tracking configuration.
@@ -1150,6 +1486,8 @@ var EvmEventTracker = /** @class */ (function () {
         this.registry.rememberChain(provider, chainId);
     };
     EvmEventTracker.prototype.untrackProvider = function (provider) {
+        // An untracked provider has nothing left to finish.
+        this.settleAdoption(provider);
         try {
             this.registry.removeListeners(provider);
             // Only stop tracking it if the listeners actually came off. "Tracked"