v68.3.0: ship the spoofing-default-off change

[ryanbr]

Roll-up release publishing the single Unreleased item (PR #232 — ad spoofing default flipped on → off). Same shape as the prior roll-up PRs (#226 v68.0.0, #231 v68.2.0): convert current ## Unreleased content into a dated ## v68.3.0 (2026-05-21) section and bump the release-pair scripts in lockstep.

What this PR does

• CHANGELOG.md: existing Unreleased bullet moved under a new ## v68.3.0 (2026-05-21) header; ## Unreleased left empty for the next cycle.
• vaft/vaft.user.js + vaft/vaft-ublock-origin.js: @version 68.2.0 → 68.3.0, ourTwitchAdSolutionsVersion 83 → 84.
• CLAUDE.md: Current: vaft 68.3.0/84 (Testing 651 preserved).
• Pure relabeling. No behavioral code change vs current master — spoofing was already disabled by default on master after Disable ad spoofing by default #232 merged. acorn-clean.

Corrected framing vs the original PR #232 body

The Unreleased bullet's "field signal" wording also corrects an inaccuracy I had in #232's body: the actually-observed symptom was a Twitch ad overlay with countdown reaching the user during a break on warn, not an in-stream ad reaching the committed backup as I'd wrongly framed in #232. The action (disable by default) still holds — the convergent rationale (admin hypothesis + always-100%-watched beacon-pattern fingerprinting concern + upstream toggle) stands — but the precise mechanism by which spoofing would drive overlay rendering is now honestly noted as unverified, because Twitch's player UI overlay is driven by local m3u8 ad-cycle tracking rather than GQL response. A server-side coupling is plausible but not established.

What to watch in field logs going forward

The next v83+ session (with spoofing default-off in effect) is the data point that decides whether the action was correctly motivated:

• Overlay-with-countdown stops appearing on similar breaks → spoofing was somehow involved (mechanism still uncertain, but the empirical decision was right).
• Overlay still appears → spoofing wasn't the cause, the overlay is driven by something else (Twitch's player ad-cycle tracking on the original m3u8 DATERANGE, etc.), and we should consider re-enabling spoofing default + looking at the overlay-hiding lever (which has its own past-rejection rationale in PR vaft: remove ad-break-card text-match hide (false-positive risk) #141).

Either outcome is informative. The localStorage opt-in (twitchAdSolutions_disableAdSpoofing='false') keeps the mechanism testable for anyone who wants to A/B it on their own channels.

🤖 Generated with Claude Code