The checklist

Small, specific details, each of which cost roughly a day somewhere in the project. None of them are obvious until you've been bitten once — worth surfacing here rather than leaving buried in the guides. Most connect to a finding from the unbuilt designs too, noted where relevant.

• document_start and MAIN world, or you see nothing. A content script in ISOLATED world patches a fetch the page never calls; a hook installed at document_idle misses page load, "often the richest payloads in the session." See guide 02 §2.
• Claim the double-injection guard flag before installing hooks, or two racing injections both pass the check. See guide 02 §2.
• Expose counters on the global — "the single most useful debugging affordance in the project… It costs three lines." See guide 02 §2.
• res.clone(), or the page gets an empty body. See guide 02 §3.
• responseText throws when responseType is arraybuffer or blob — symptom is rising matched with zero captured, which "looks like success from a distance." Cost three capture runs. See guide 02 §3.
• content-type is not a reliable filter — modern apps serve structured data as application/octet-stream. See guide 02 §3.
• Deny-lists over allow-lists: "an allow-list fails silently when the target adds an endpoint; a deny-list fails loudly when it adds noise." Measured: narrow 14, wide 33, all 181. See guide 02 §4.
• The noise list is an optimisation; the deny list is a privacy floor — and the floor is per transport, so a second API stack needs it re-derived. See guide 02 §4.
• Declare unlimitedStorage or the browser may discard the extension's IndexedDB wholesale under disk pressure. See guide 02 §5.
• A cap tuned for a dense format silently guts a sparse one — 1 MiB was right for dense JSON and started cutting the two most valuable responses per run once the target moved to server-driven UI. See guide 02 §3.
• activeTab + scripting grants the current page only on explicit invocation, with no install-time warning — replaces broad host permissions and the review delay they attract, but means the extension cannot watch pages in the background. Opposite posture from the recorder above. See the Scribe, U3.
• The remote-code rule bans executable code, not data — a vault fetch is ordinary; only loading a vault-hosted application into the extension is ruled out. See U6.
• Hold a channel, not a key — a login does not solve key storage, it only moves it. See the Scribe, U3 and the secrets manager, U4.
• Chrome Sync's synchronised store is 102,400 bytes / 512 items / 8,192 bytes per item / 120 writes a minute, and its own documentation does not state it is encrypted. Treat it as an untrusted transport for ciphertext, never plaintext. See U4.