Processing-choice verification

18 October 2026. Linked to REQ-PRODUCT-PROCESSING-CHOICES and partial REQ-US-CA-CHOICES. This verifies a technical opt-out mechanism, not a regional compliance pack.

Automated package checks exercise archive/classification binding, host-only identity/provenance, transactional union and rollback, immutable retries with the current head, lost acknowledgment followed by reload, notice replacement retaining omitted activities, fail-closed reads/storage failures, stale reads, acknowledgment artifact/event mismatch, harmless JSON ordering, destroyed transports and independent cookie/service permissions. UI checks distinguish pending delivery, confirmed recording and deliberate recovery when original request data is missing. Site checks cover protected endpoints, origin/size limits and fixed host context.

Chromium and local Workers observations

• In the loopback fixture, allowing the optional cookie purpose started both first-party sample services. A separate opt-out retained revision 1, stopped advertising and left unclassified local tools active. Cookie permission remained allowed. Reload kept advertising blocked and initiated only the sample tools request.
• At 390×844 and 320×700, client and scroll widths matched. The long action label wrapped inside the card; its 320px-viewport control was about 69px high. This inline route creates no automatic opt-out modal. The cookie controls remain their separate deliberate interface.
• Activity/provenance search (sharing explicit-opt-out) found the synthetic event. Detail cards showed requested activities, historical cumulative restrictions, current retained state, exact wording/action, host provenance and privacy version. Technical references and complete JSON stayed under disclosures.
• The real SQLite-backed Worker rejected unauthenticated reads and injected context, then recorded an explicit opt-out. After stopping and restarting the Worker with the same persistence directory, the runtime check recovered the identical receipt, current head and pinned context. This used authenticated HTTP checks; browser Basic-login entry failed, so visual checks used the loopback host with the same package renderer instead.
• The loopback server uses memory: restarting it resets that fixture. A retained browser minimum revision then kept covered processing blocked when the reset server reported an older head; a fresh deliberate opt-out re-established a matching synthetic record. This is separate from the SQLite restart check above.

Screenshots: mobile opt-out and admin context.

Cross-browser, assistive technology, alternative methods, host identity continuity, downstream vendor handling, retention/erasure operations and reviewed jurisdiction applicability remain unverified.