Contract-action verification

Requirements: REQ-PRODUCT-CONTRACT-ACTIONS, REQ-DE-CANCEL, REQ-DE-WITHDRAWAL, REQ-EU-WITHDRAWAL, REQ-BR-CONTRACT, REQ-PRODUCT-EVIDENCE-LIFECYCLE.

The initial mechanism has fifteen focused package tests in packages/notabenda/test/contract-action.test.mjs and packages/notabenda-cf/test/contracts.test.mjs. They exercise all four profile definitions, exact reviewed/archive references, rendering-policy/locale identity, direct cancellation versus withdrawal review, no mount-time transport, independent durable jobs, original receipts under concurrent/lost-response retries, incompatible nonce reuse, old forms after a newer definition, transactional write failure, wrong host operation/site/action scope and private inspection with escaped visitor strings.

Dispatch tests use local stand-ins. They cover independent acknowledgement when application dispatch is uncertain, exclusive claims, stable downstream delivery IDs/digests, expired leases, stale settlement and terminal provider acceptance. Provider acceptance is not recipient delivery or contract fulfillment. No email or external application is contacted.

Lifecycle checks are declaration-specific. Pending/uncertain/leased jobs prevent retirement until the host drains or explicitly quiesces them. The trusted quiescence assertion is not proof that an external effect stopped; the host must actually enforce it. Retired payload is withheld, purge removes the event and its embedded jobs together, restored replay remains fenced, and a new declaration remains possible.

Native DOM/controller tests cover visible-field revalidation (including multi-byte edits and silent DOM updates), accessible labels, a distinct final action, no privacy-acceptance checkbox, focus after receipt, exact savable text, bounded hung transport, immutable recovery and refusal of accessor-based inputs. The native links announce new tabs. Four site tests exercise actual session admission, cross-session isolation, body limits, exact private state filters, seeded delivery states, and the executed browser client’s tab-scoped recovery without automatic transport. Failed recovery reads refuse a fresh controller; quota failures send no POST and retain the same in-memory command for explicit retry after repair. These do not establish the screen-reader or full platform matrix.

The catalog records source access honestly. German consolidated sections 312k/356a and Brazilian Consumer Code article 49 / Decree 7,962 article 5 were read directly. The EU directive's official indexed provisions were available, while direct full-text/PDF retrieval encountered a script/robot challenge. National/sector/window and case-law review remain open. These mechanics do not constitute reviewed production regional packs.

The optional scripts/check-contract-actions-runtime.mjs ran successfully against a disposable local Wrangler Worker and real SQLite Durable Objects. Four concurrent exact submissions returned one original receipt; both jobs and the exact acknowledgement were stored. Wrong-generation requests and cross-session inspection were refused. Withdrawal, German ordinary cancellation, private export and original receipts survived stopping and restarting the Worker with the same SQLite state. A new nonce remained an independent declaration. The script stops its own server; it invokes no provider or application runner.

Initial Chromium walkthroughs exercised withdrawal review/final receipt and direct German cancellation with no extra review gate. At 320px and 390px, native fields used 16px text and at least 48px heights, without horizontal overflow. The withdrawal review focused its final action. After following the recorded declaration into admin and returning through a full reload, the page offered the same sealed request; an explicit retry returned the byte-identical acknowledgement, original nonce and original browser/host times. A prematurely visible inspection link caused by stylesheet precedence was corrected. Browser Back performed a full reload instead of BFCache restoration, prompting the tab-scoped recovery integration and regression above. Mobile review and operator state filtering capture the final shared design. The actual uncertain-confirmation filter selected the seeded uncertain record and excluded pending/accepted records.

The browser adapter did not complete Blob-download verification; exact Blob content/link and selectable-text output are covered by DOM tests. A clicked download is not being claimed as a verified saved file.

The optional dispatch-runner verification now covers controlled-clock lease restart recovery and independent provider-simulation deduplication in separate local SQLite Durable Objects.

Still open: actual installed/rehearsed independent runners, real provider acceptance/recipient delivery, operational lifecycle drills, current national/sector/case-law review and the broader browser/assistive-technology matrix. The feature and regional verification remain partial.