Decision: adopt the versioned confirmation candidate for
capability-negotiated customer and admin web confirmation lanes.
The candidate is presentation only. The parent action id and one-shot server confirmation bridge retain execution authority, and any invalid or unsupported candidate falls back to the existing deterministic confirmation.
Usefulness comparison#
The rubric is cross-surface: a baseline item counts only when both the customer and admin confirmation lanes expose it consistently.
| Criterion | Existing deterministic UI | Candidate |
|---|---|---|
| review-heading | no | yes |
| authoritative-summary | yes | yes |
| explicit-product-scope | no | yes |
| pre-confirm-consequence | yes | yes |
| recovery-or-undo | yes | yes |
| unambiguous-decisions | yes | yes |
| bound-pending-state | yes | yes |
Score: baseline 5/7; candidate 7/7; improvement +2.
Reliability controls#
| Case | Expected | Observed |
|---|---|---|
| valid-candidate | accepted | accepted |
| unknown-component | fallback | fallback |
| unknown-hostile-prop | fallback | fallback |
| executable-markup | fallback | fallback |
| cross-action-replay | fallback | fallback |
| stale-state-replay | fallback | fallback |
| exact-state-replay | accepted | accepted |
All 7 cases passed. Unknown components, unknown/hostile props, executable markup, cross-action replay, and stale state all select the deterministic fallback. Exact replay preserves one render key while the server bridge preserves one-shot execution.
Performance#
The strict decoder measured p95 0.003716 ms over 30000 iterations against a 1 ms budget. The candidate wire payload is 537 bytes.
Honest boundary#
- The adopted v1 registry contains exactly one confirmation component; arbitrary remote components and URL-bearing props are unsupported.
- The deterministic confirmation remains the execution-capable fallback and the server confirmation bridge remains the sole write authority.
- The usefulness result is a preregistered information-completeness rubric, not a human-subject preference study.
- Task 8.8 retains manual assistive-technology ownership; this task records automated semantics and axe evidence only.
- Phase 8 and G9 remain open for the remaining interaction, voice, accessibility, and parity tasks.
Record digest:
6270d6d8de3d11da6ebef6c723cef674842a3b2ce380ee0c5459d1655f4f0ffa.