Four guides from five weeks building a Manifest V3 browser extension that records a web application's own network traffic — against an undocumented target that changed its entire API stack mid-project. They return something reasonable-looking, and you find out weeks later when a number does not match a screenshot. This site is the guard rail: what to build first, what to verify against, and the six ways it goes quietly wrong.
The four guides compress to five sentences. They are the site's front page because they are good enough to be one.
No parsers, no domain model — just keep the bodies. Every parser you write afterwards is written against evidence instead of a guess.
Every claim that survived this project was checked against something the target emitted independently. Every claim that collapsed was plausible and unchecked.
An old build, a size cap that excludes exactly the evidence you're testing for, res || {}, new Blob([undefined]). Each looked like success for days or weeks.
null, and null never becomes 0, '' or {}Report coverage next to results, so "there is no edge here" and "we never looked here" stay different sentences.
A doc with visible errata is one you can trust the rest of. This site does the same — including at its own expense.
This is an instrument for observing your own session and your own data, on an account you hold, recording only what the service already sent to your browser. It originates no requests, transmits nothing, and captures no message content in any mode. Anyone reading it as a scraping guide has the wrong document — and the four invariants below are what make it safe to leave running, not just what make it defensible.
It wraps fetch/XHR and reads what came back.
The original promise is returned untouched; the body is read from a clone.
Every hook is wrapped in try/catch.
Export is a manual download.
The founder's own words: the extensions here are "all with different levels of quality." The measured answer, confirmed 8 September 2026: one has been built. A site showing only the shipped one would be a more flattering artefact and a less useful one — the unbuilt designs bought platform findings without a line of code.
A plan (recalled), a shipped tool (measured), a correction (read) — three efforts, three epistemic states, the newest correcting the oldest before a line of code existed.
Read → Platform findings, no codeKey Vault, risk cards, the Scribe, the secrets manager, the manifest as a profile, and the vault as storage — six proposals, each dated, each stating what it discovered.
Read →Written by an agent for other agents, 8 September 2026, from a project at v0.16.0: ~3,400 lines of extension source, 176 tests, 33 numbered lessons, 12 capture runs. They ship here almost unchanged — the site adds navigation and cross-links, not a rewrite. Read guide 01 first, because the method is what produced the rest.
How the human and the agent divided the work, phase 0, evidence discipline, corrections left in place, the failure-mode table.
Read → 02MAIN vs ISOLATED world, capture modes, storage, the circuit breaker, build provenance, the boundary that only fails once data gets big.
Read → 03Probing envelopes, deriving timestamps from identifiers and proving them, reading markup over English, document-shaped payloads.
Read → 04The code/data split, the deriver as the seam, per-entity records with history, and a viewer that ships as one file.
Read →What each cost — ten days, three weeks, a 113 MB export written as the word "undefined." Every one invisible by construction.
Read → Day-oneThe details that save a reader a day each: document_start in MAIN world, the double-injection guard, deny-lists over allow-lists.
Grade an extension yes / no / not-applicable against incidents that actually happened — and see the three efforts graded against it, including this project's own.
Read → Source of truthThe four guides, readable in-page, with the raw markdown as the source of truth underneath.
Read →The guides are written from one extension: a passive recorder that never originates a request. A guidance site that implies broader coverage than its evidence supports fails its own rule.
No page-modifying extensions. No injected UI into a target. No declarativeNetRequest. No OAuth flows. No multi-origin content scripts. No Chrome Web Store publishing guide. No comparison of extension frameworks. And the target the recorder was built against is never named — see the boundaries and disclosure.