Removing read protection with STM32F_Unprotect()

By using the javascript function STM32F_EraseOptionBytes() from targets/STM32/STM32_Target.js, I can successfully protect an STM32F103 from reading/verifying. That works well.

From the package description and the ST manual (PM0075), I was expecting to be able to reverse the read protection (and, as a desired side effect, erase the flash) by programming the RDP option byte at 0x1FFF F800 using STM32F_Unprotect(). The sequence I'm using is:

Connect JTAG, apply power, connect to the target, open javascript console

> load("targets/STM32/STM32_Target.js")
true
>STM32F_EraseOptionBytes()
>STM32F_Unprotect()

Remove power, remove JTAG. Wait a beat. Connect power.

I expected that the processor would be erased and un-protected at this point. However, it still has the run-time code and is still read protected.

I've also tried skipping the "extra" STM32F_EraseOptionBytes() after power-on reset and going right to STM32F_Unprotect(). No change. Similarly with menuing to Target | Disconnect before pulling power.

Using STM32 package 2.18 under CrossWorks 2.3.1. The package status is "OK" for all installed files.

I'm probably missing something obvious, but ?