# Feedback and selected testimonials — v0.17 28 October 2026. Local fictional-data prototype. No email, customer onboarding or public deployment has occurred. The [bounded browser walkthrough](FEEDBACK-WORKFLOW-WALKTHROUGH.md) is verified; broader phone, accessibility, portal-feedback and edge-case UI checks remain pending. ## Owner: prepare an exact request 1. In Jobs, use an invented customer with a `.example` email address. Complete the job, then open **Feedback**. 2. Select the exact job/customer record. Short record IDs distinguish duplicate names or email addresses. The list explains ineligible jobs and shows previous requests. A new request needs a completed job; an existing active request or unarchived response must first be reviewed and revoked/archived. Preparing another request requires a reason. 3. Choose 1–30 days of access (14 by default) and select **Prepare local capture**. The record says **captured locally, not sent**. It does not verify email ownership. 4. Open the protected local capture. Copy its feedback-only code to the local feedback page. Codes are entered in a form, never put into a link/query string. A capture is a local stand-in for delivery, not a sent message. The owner can review expiry, reissue with a reason, revoke, hide or archive. Reissue invalidates earlier codes. Revocation/archive also hides a published testimonial and suspends its permission; reissue alone cannot publish it again. Archived requests stay archived. Original answers and request/customer/job links remain recorded. ## Customer: private answers and an independent public choice Enter the feedback code at `/feedback/`, or sign into the exact customer portal and open **Your feedback requests**. The code grants only feedback access; it cannot log into the portal or retrieve jobs, contacts, quotes, invoices or PDFs. It can manage that request until expiry/revocation. It is a bearer credential, not verified proof of email ownership. Choose all four ratings, answer the recommendation question and enter private comments/improvement suggestions. These original answers are immutable after submission. Public permission is off by default. To offer a testimonial, separately enter the exact public display name and statement; separately choose whether the overall rating may be displayed. The form shows that projection before confirmation. It never copies private comments, names, addresses or job details into it. Confirm and submit once. Repeating the identical operation after a network failure returns its recorded result while access remains valid. A different second submission, stale version or concurrent loser is rejected for review. Do not interpret an error as a saved withdrawal: reload the current state and deliberately retry. Reissued, expired and revoked codes cannot replay a prior mutation. The feedback-only page rechecks access after same-origin access/context changes, on focus/visibility and every 30 seconds while visible. Failed/unavailable checks clear private content and the code; a 10-second deadline bounds an unfinished check. Valid checks preserve unsaved choices. Other-device/background timing remains unverified. A customer can replace their public permission/text or withdraw it. Any replacement immediately hides the prior publication and needs another owner preview/publication. The original private answers remain unchanged. A signed-in exact customer can withdraw permission even after the request closes. After code expiry, use the portal or ask the owner to hide the testimonial and review access. No new permission can be granted to an archived, stale-contact or stale-job request. ## Owner: review, preview and publish The owner sees the private response separately from **Public testimonial preview**. There is no owner text/rating editor, manual review fabrication or imported Google/Facebook review feature. Only the customer's exact approved name, statement and optional rating can be published. Preview, tick the confirmation and choose **Publish testimonial locally**. Returning with **Back to feedback** refreshes the list and counts; stale previews are rejected by the server. The public page is `/site//reviews/selected`; existing editable `/reviews` pages are preserved. The home page shows up to three current selected testimonials. The public API returns only the fixed projection and selection label/count. It shows no overall average. Owner statistics include **all saved responses**, including private/archived ones, and count explicit recommendation answers rather than inferring recommendations from high ratings. Owner hiding removes a testimonial without editing customer permission. Customer withdrawal, archive/revocation, contact correction and material job changes remove it and preserve history. Material changes require a new exact-record request; restoring old contact text does not revive approval. Private owner notes, priorities and tags preserve permission. A no-op contact save also leaves it intact. Supported reviewed transfers revoke affected access/sharing and retain original consent identity; they do not silently move permission to the retained customer. Website history restores only website content; it contains no testimonial rows and cannot revive withdrawn permission. Every new page/feed retrieval uses current permission and `Cache-Control: no-store`; the home strip refreshes on window focus. Existing open pages or copies already downloaded are not remotely recalled. No service worker, tracker, external embed, URL fetch or arbitrary HTML is introduced. ## Backup and restore Stop the application and follow [Backup and recovery](BACKUP-AND-RECOVERY.md). Current format 11 preserves original responses, request and consent versions/times, publication projections, and action histories alongside earlier account/document/field/photo/recurrence records. Usable codes, token hashes and capture files are excluded. Pinned formats 1–10 remain supported for validated migration into a fresh folder. The format-11 schema marker remains 0.14.0; this client repair adds no schema. After restore, all old feedback codes fail and every testimonial is hidden. Requests are revoked (archived requests remain archived); previously approved consent is suspended. A recovered owner must explicitly renew eligible access, the customer must approve the desired public text again, and the owner must preview and publish again. Old portal passwords/sessions remain revoked under the existing recovery rules. Nothing is delivered or published merely by restoring. ## Scope still open This implements the local WEB04 journey. Source manual imports, third-party review services, real delivery/verified identity, retention/legal policy, production consent wording and live hosting are not approved. Broader opportunities/reporting and assisted-training videos remain incomplete. All fourteen findings in the unchanged SHS export/live system remain OPEN; this independent implementation does not remediate them. The normal demo has no seeded feedback or testimonials.