The commissioning decision
An agency connects a polished custom send control to an enquiry form. Clicking it appears to work, but the implementation calls a method that bypasses the form submit event and browser validation. Specify the event path as an acceptance condition, not just the colour change on the button.
Source and claim boundary
Direct form.submit does not run constraint validation or emit the submit event. requestSubmit follows the submit-button path instead. MDN · Checked 16 October 2026.
Filled synthetic acceptance cases
Synthetic teaching data, not client records. Review the inputs and expected outcomes before running the isolated browser exercise. On narrow screens, scroll the table.
| Input | Check | Expected |
|---|---|---|
| Required email empty | requestSubmit, prevented locally | No submit event |
| Required email syntactically valid | requestSubmit, prevented locally | One submit event |
| submit handler prevents default | Network request | None in this fixture |
How to verify beyond appearance
- Identify all ways a visitor can trigger sending, including keyboard and custom controls.
- Run the empty and populated cases; the fixture cancels submission and stays offline.
- Verify the receiving endpoint separately rejects invalid requests even if browser checks are bypassed.
Interpret the result
A local submit event is not a delivered enquiry. Keep the event count, validation state and later integration result as separate fields. The browser provides useful feedback but is not a trust boundary. If the team uses custom validation, its accessibility and server-side rules need independent evidence rather than a claim that requestSubmit alone fixes everything.
What this does not prove
No real form endpoint is called. The exercise demonstrates native validation routing in the tested browser, not every framework or device.
Runnable fixture and handover record
Open the browser acceptance fixture · Read the test source。The fixture creates temporary elements with synthetic values inside the browser. It reads no account, uploads no file, and sends no email or form. Record the browser version, check name, observed value and pass state. Keep real integration evidence separate: a local pass is not a live delivery result.