# Processing-choice verification 18 October 2026. Linked to `REQ-PRODUCT-PROCESSING-CHOICES` and partial `REQ-US-CA-CHOICES`. This verifies a technical opt-out mechanism, not a regional compliance pack. Automated package checks exercise archive/classification binding, host-only identity/provenance, transactional union and rollback, immutable retries with the current head, lost acknowledgment followed by reload, notice replacement retaining omitted activities, fail-closed reads/storage failures, stale reads, acknowledgment artifact/event mismatch, harmless JSON ordering, destroyed transports and independent cookie/service permissions. UI checks distinguish pending delivery, confirmed recording and deliberate recovery when original request data is missing. Site checks cover protected endpoints, origin/size limits and fixed host context. ## Chromium and local Workers observations - In the loopback fixture, allowing the optional cookie purpose started both first-party sample services. A separate opt-out retained revision 1, stopped advertising and left unclassified local tools active. Cookie permission remained allowed. Reload kept advertising blocked and initiated only the sample tools request. - At 390×844 and 320×700, client and scroll widths matched. The long action label wrapped inside the card; its 320px-viewport control was about 69px high. This inline route creates no automatic opt-out modal. The cookie controls remain their separate deliberate interface. - Activity/provenance search (`sharing explicit-opt-out`) found the synthetic event. Detail cards showed requested activities, historical cumulative restrictions, current retained state, exact wording/action, host provenance and privacy version. Technical references and complete JSON stayed under disclosures. - The real SQLite-backed Worker rejected unauthenticated reads and injected context, then recorded an explicit opt-out. After stopping and restarting the Worker with the same persistence directory, the runtime check recovered the identical receipt, current head and pinned context. This used authenticated HTTP checks; browser Basic-login entry failed, so visual checks used the loopback host with the same package renderer instead. - The loopback server uses memory: restarting it resets that fixture. A retained browser minimum revision then kept covered processing blocked when the reset server reported an older head; a fresh deliberate opt-out re-established a matching synthetic record. This is separate from the SQLite restart check above. Screenshots: [mobile opt-out]() and [admin context](). Cross-browser, assistive technology, alternative methods, host identity continuity, downstream vendor handling, retention/erasure operations and reviewed jurisdiction applicability remain unverified.