Tags: SysAdminDoc/ScriptVault
Tags
chore: release v3.27.0 — recoverable restores, real isolation & hones… …t errors Eight audit findings closed this pass: - The restore receipt — the only undo — is written BEFORE the mutation chain and finalized after, so a service worker killed mid-restore leaves a recoverable snapshot instead of mixed data and an empty ledger. Import paths, whose snapshot accumulates during the loop, bracket their writes with a mutation journal. - Firefox per-script world support is now PROVEN by configuring a throwaway world and reading it back, not inferred from a symbol that shipped before the feature. Both fallbacks record a warning instead of silently sharing one sandbox, and a world id starting with `_` no longer costs a script its isolation. - Update failures are classified (host-challenge / transport / http-status / not-a-userscript / parse-error); only a genuine parse error advances the script's retry ring, so a challenged host no longer silences its updates. - Custom and extra-preset themes reach the popup, side panel, install review and DevTools panel through one shared applier. - Deleting a custom theme confirms first and meets the 24x24 target minimum. - The debugger names scripts instead of showing raw UUIDs. - release:check:public is passable again: it demanded a signed tag while the project ships unsigned by policy, so it had failed silently for three releases. Version synced across package.json, package-lock.json (both fields), both manifests, the README badge/footer/runbook/generated support matrix, the CHANGELOG heading, the What's New entry and CLAUDE.md. v3.26.0 is now tagged at the commit that carried its manifest, closing the release-tags gate. Unsigned artifact rebuilt as ScriptVault-v3.27.0.zip (previous one deleted).
PreviousNext