# Eve typed generative-UI decision — Task 8.6

**Decision:** adopt the versioned `confirmation` candidate for
capability-negotiated customer and admin web confirmation lanes.

The candidate is presentation only. The parent action id and one-shot server
confirmation bridge retain execution authority, and any invalid or unsupported
candidate falls back to the existing deterministic confirmation.

## Usefulness comparison

The rubric is cross-surface: a baseline item counts only when both the customer
and admin confirmation lanes expose it consistently.

| Criterion               | Existing deterministic UI | Candidate |
| ----------------------- | ------------------------- | --------- |
| review-heading          | no                        | yes       |
| authoritative-summary   | yes                       | yes       |
| explicit-product-scope  | no                        | yes       |
| pre-confirm-consequence | yes                       | yes       |
| recovery-or-undo        | yes                       | yes       |
| unambiguous-decisions   | yes                       | yes       |
| bound-pending-state     | yes                       | yes       |

Score: baseline 5/7; candidate 7/7; improvement +2.

## Reliability controls

| Case                 | Expected | Observed |
| -------------------- | -------- | -------- |
| valid-candidate      | accepted | accepted |
| unknown-component    | fallback | fallback |
| unknown-hostile-prop | fallback | fallback |
| executable-markup    | fallback | fallback |
| cross-action-replay  | fallback | fallback |
| stale-state-replay   | fallback | fallback |
| exact-state-replay   | accepted | accepted |

All 7 cases passed. Unknown components, unknown/hostile props, executable
markup, cross-action replay, and stale state all select the deterministic
fallback. Exact replay preserves one render key while the server bridge
preserves one-shot execution.

## Performance

The strict decoder measured p95 0.003716 ms over 30000 iterations against a 1 ms
budget. The candidate wire payload is 537 bytes.

## Honest boundary

- The adopted v1 registry contains exactly one confirmation component; arbitrary
  remote components and URL-bearing props are unsupported.
- The deterministic confirmation remains the execution-capable fallback and the
  server confirmation bridge remains the sole write authority.
- The usefulness result is a preregistered information-completeness rubric, not
  a human-subject preference study.
- Task 8.8 retains manual assistive-technology ownership; this task records
  automated semantics and axe evidence only.
- Phase 8 and G9 remain open for the remaining interaction, voice,
  accessibility, and parity tasks.

Record digest:
`6270d6d8de3d11da6ebef6c723cef674842a3b2ce380ee0c5459d1655f4f0ffa`.