The commissioning decision
A supplier locks a quote reference so visitors cannot edit it, then discovers that the enquiry arrives without it. The design decision is not merely whether a field looks grey. Specify whether it must be sent, selectable and focusable, and independently verify which quote the server is allowed to use.
Source and claim boundary
Disabled controls are excluded from form submission; supported readonly inputs remain submitted. Neither attribute is an authorisation boundary. MDN · Checked 16 October 2026.
Filled synthetic acceptance cases
Synthetic teaching data, not client records. Review the inputs and expected outcomes before running the isolated browser exercise. On narrow screens, scroll the table.
| Input | Check | Expected |
|---|---|---|
| reference=Q-18, readonly | FormData has reference | Q-18 |
| reference=Q-18, disabled | FormData has reference | Absent |
| reference=Q-19, script changed readonly value | Client value can change | Server must verify permitted reference |
How to verify beyond appearance
- List fields that are display-only, submitted or independently resolved on the server.
- Compare disabled and readonly examples in the fixture.
- Attempt a changed reference in a non-production integration and confirm the server rejects unauthorised access.
Interpret the result
A missing reference may explain a routing failure, but restoring a hidden or readonly field is not a security fix. Preserve the payload difference, the receiving endpoint decision and the redacted result. A successful browser example says nothing about ownership of a quote. Server-side authorisation must be proven by its own negative test.
What this does not prove
Readonly does not apply to every control type. The fixture uses a text input, not a select. Do not expose real quote IDs while testing.
Runnable fixture and handover record
Open the browser acceptance fixture · Read the test source。The fixture creates temporary elements with synthetic values inside the browser. It reads no account, uploads no file, and sends no email or form. Record the browser version, check name, observed value and pass state. Keep real integration evidence separate: a local pass is not a live delivery result.