# Visitor and operator usability review Requirements: `REQ-PRODUCT-FORM-PERMISSIONS`, `REQ-PRODUCT-SETUP`, `REQ-PRODUCT-A11Y`, `REQ-PRODUCT-MOBILE`. This review follows the tasks each audience needs to complete. It is an implementation and local Chromium review, not an accessibility certification or the full platform matrix. ## Visitor tasks - **Understand and refuse optional work.** The cookie drawer has explicit purpose labels and equally reachable reject/save actions. An actual mobile keyboard walkthrough moved from its heading through Close and the first checkbox; Escape restored the original opener. Reopening discarded the unsaved draft change and optional services remained off. Descriptions and provider names now explain the purpose without repeated fictional-data messaging. - **Know whether a choice is saved.** The form permission field distinguishes unchecked draft, locally retained request and confirmed host state. Acknowledged grants and pending requests show their exact statement without an unchecked checkbox suggesting the opposite. Plain status copy describes the next step. Save/retry have a primary treatment; withdrawal stays available; the saved-state check disappears after it has done its job. - **Recover when recording fails.** A temporary local recording proxy returned controlled failures while the real browser used IndexedDB and the actual local Worker. A grant and a withdrawal each survived reload and retried byte-identical commands. The observed requests were grant, identical grant retry, withdrawal, identical withdrawal retry. Reload and local reconciliation created no recording request. The pending withdrawal remained restrictive until the host confirmed it. The proxy was stopped after verification; it is not a product route. [Mobile pending withdrawal](). - **Keep keyboard context.** Automated DOM/controller checks cover successful saved-state checks, uncertain grants, explicit recovery and focus transfer when a button disappears or becomes disabled. Focus stays on a visible retry, checkbox, withdrawal action or status. Background state updates do not steal focus from elsewhere. - **Understand unavailable choices.** Restricted scopes explain the need for a separate process and retain withdrawal/help without presenting an impossible selectable draft. The current replacement offer asks for review, while an actually stale mounted offer asks for reload. A deactivated offer says it is unavailable. The example's help link now opens the rights section of the exact referenced privacy page instead of linking back to itself. - **Read documents and understand separate actions.** Generated route tests retain script-free legal pages, exact pinned content, distinct terms agreement and privacy links, and independent form submission. Terms state the version/effective date and announce their new-tab policy link; recording status waits for acknowledgment. Rights entry points explain application handoff and do not claim request submission. ## Operator tasks - **Configure accurate public facts.** URL/email/slug validation shows a specific inline correction and focuses the field instead of failing later with a generic message. Enter in a public field continues to the next section. Imported facts are shown beside override fields; leaving an override blank preserves the imported value. Actual Chromium verified a non-HTTPS URL error, correction and Enter-to-Markets navigation. - **Record private reasoning.** Practice select and justification names include the question for assistive technology. Actual Chromium verified the named controls and navigation to review; automated checks preserve private notes, invalidate stale exports and keep the public config separate from the private report. - **Know what blocks publication.** Review displays diagnostic paths, messages and requirement links, with additional fixes expandable. Draft config and private report remain separate downloads. Preparing a draft does not mark it production-ready. Actual review showed specific unresolved controller/site fields instead of only an error count. [Setup review](), [mobile field error](). - **Follow a permission's context.** Result cards identify the opaque contact reference and link directly to matching permission history in the already authorized store. A complete single-contact search is shown in recorded event order; bounded/general segments keep their explicit key-order and count limits. Detail separates recorded historical action from current evaluation, gives a human explanation and retains technical references in a disclosure. Exact current-state filters distinguish allowed, withdrawn and changed-offer choices without matching historical grants or JSON field names. They preserve contact searches and export selection. Actual Chromium followed a history link to two matching grant/withdrawal records, confirmed that Allowed excluded them and Withdrawn restored their recorded order. [Permission history](). - **Retain evidence through content updates.** Earlier public preview artifacts are explicitly retained and validated. Current wording changes do not rewrite pinned pages. The operator walkthrough found an existing-workspace seed conflict after a notice update; seed streams now include notice identity. A regression verifies new journeys, unchanged old receipts and idempotent resume, and the existing local workspace reopened successfully. ## Evidence and remaining checks Relevant tests: `packages/notabenda/test/form-permission.test.mjs`, `packages/notabenda/test/setup.test.mjs`, `site/test/demo.test.mjs`, `site/test/host.test.mjs`. The deployment-tree test resolves the complete browser import graph, including the optional journal. The journal tests use a development-only IndexedDB implementation to exercise real transactions/abort behavior as well as actual browser interaction above. The review does not establish the complete screen-reader, WebKit/Firefox, physical iOS/Android, forced-colors, text-size/zoom, translation/RTL or on-screen-keyboard matrix. Those remain acceptance work. Local restriction while offline cannot instantly change a remote sender or host process; the interface distinguishes it from a confirmed withdrawal. The optional Google Basic example follows the same visitor controls and shared light/midnight design. Its local execution trail and reload boundary have a separate [verification record](), including narrow-screen and keyboard observations. Mobile documentation now starts with a native collapsed “Browse documentation” menu, preserving the full sidebar on desktop. The article is visible in the first mobile screen without requiring JavaScript. Shared link parity and collapsed markup are checked in `site/test/guide-navigation.test.mjs`; keyboard expansion and narrow-screen layout are checked in Chromium. ## Contract-action follow-through The optional declaration module received a separate visitor/operator walkthrough and Astra review. Native editing-stage submission now reads the visible controls again; a UTF-8 limit failure cannot silently submit an earlier valid value, and silent valid DOM/autofill changes are included. Withdrawal has review/edit/final action; German continuing-contract cancellation retains its direct final action. Uncertain attempts use an explicit same-request retry label, and pinned document links announce their new-tab behavior. The browser walkthrough found that Back from admin can reload a page rather than restore BFCache state. The example now explicitly retains its exact command within that session’s tab and never retries on load. It preserves the mounted view for persisted pagehide and later destroys it on actual unload. Native package code itself does not persist personal fields. The deliberate example refuses unreadable recovery state and sends no POST after a failed recovery write; repair retries the same in-memory command. Production hosts must choose a recovery design without making browser storage an unjustified obstacle to statutory intake. Full platform acceptance remains open. Operators receive separate confirmation/application states and direct state filters while keeping a contact/reference search. A received declaration, provider acceptance, recipient delivery and contract fulfillment remain distinct. See [the focused contract-action verification](). The final Chromium pass verified 320px/390px layout, 16px fields, at least 48px form targets, announced document links, exact receipt recovery after Back/full reload, and operator filtering of uncertain confirmation. All 408 automated tests passed, plus the disposable local SQLite capture/restart check and Worker dry run. Downloaded-file, full screen-reader and broader platform acceptance are not claimed.