Digital Accessibility Audits for Smart Property Interfaces: A Research Protocol for Evidence-Constrained Digital-Twin Inspection

1. Introduction

This protocol concerns accessibility failures that arise at the junction of digital interaction and building use. A smart property interface, as defined in this manuscript, is any digital or digitally mediated touchpoint through which a person must obtain access, receive occupancy-relevant information, submit a property-related request, acknowledge an alert, or complete a transaction required for ordinary use of premises. The relevant unit is therefore not software in isolation, but a task-channel episode occurring at a specific physical location under observable environmental conditions.

The practical problem is that the same task may depend simultaneously on interface logic, device placement, route geometry, lighting, noise, local crowding, and availability of an alternative channel. A screen may present legible labels yet remain unusable if mounted beyond reachable height; an intercom may technically support speech output yet fail in a noisy lobby; a mobile credential may be designed accessibly in abstract terms yet still exclude users when network connectivity is weak at the point of entry. For protocol purposes, these are treated as interface-in-context barriers rather than as separate software and building defects.

The closest transferable workflow evidence comes from building digital-twin inspection studies that connect visual capture, structured scene representation, and rule-based judgment. One indoor inspection framework reconstructs a residence from smartphone video, stores measurements and semantic labels in a unified scene record, formalizes inspectable hazards through computable prototypes, and uses follow-up queries to resolve uncertainty. A second study combines digital-twin reconstruction with point-cloud semantic segmentation so that objects and site conditions can be identified and localized in three dimensions for safety pre-control. Although neither study addresses accessibility auditing directly, both show how inspectable conditions can be tied to retrievable evidence rather than to free-text impression alone. [1] [2]

The protocol proposed here adopts that evidence discipline. An evidence-constrained digital-twin process is defined as an audit process in which every positive, negative, or indeterminate judgment must be linked to stored observations, stored measurements, or an explicitly documented probabilistic inference whose inputs, assumptions, and missing variables are visible for later review. The manuscript does not claim that this protocol is validated. Its purpose is to specify a falsifiable method in sufficient detail for later empirical testing.

Digital-content accessibility and physical access require distinct reference layers. WCAG 2.2 defines testable web-content criteria, while the U.S. Access Board presents technical provisions for covered physical facilities. The proposed task-in-context index is supplementary to those reference layers. Neither a high aggregate score nor an available alternative channel establishes WCAG conformance or compliance with applicable building-access requirements. Standards applicability and conformance assessment must be documented separately for the actual system and jurisdiction. [3] [4]

2. Evidence scope and research question

The primary research question is: how can accessibility audits for smart property interfaces be structured as an evidence-constrained digital-twin process that integrates interface characteristics, surrounding spatial conditions, environmental context, and uncertainty handling? Subsidiary questions follow from that aim: which variables are required for reproducible in-situ judgments; how should alternative channels be counted; when may proxy evidence support classification; and how can repeated or cross-property learning occur without centralizing sensitive local data?

The evidence base for this article is a targeted narrative synthesis, not a systematic review. The synthesis privileges studies whose methods are transferable to the audit problem. Directly relevant workflow analogues are the indoor safety inspection study based on smartphone video and structured scene records, and the construction-site digital-twin study based on 3D reconstruction and semantic segmentation. These sources support the proposition that environments can be reconstructed into queryable digital representations linking geometry, object identity, and inspectable conditions. [1] [2]

Three additional sources inform method design rather than direct accessibility evidence. The belief-based BIM/digital-twin study shows how a Bayesian Network can express uncertainty when direct observations are incomplete, while also warning that expert-belief probabilities are not empirical validation. The multi-zone smart-building sensing study contributes only an architectural lesson: event-driven monitoring can scale computation to meaningful environmental change rather than fixed continuous processing. The federated-learning study contributes data-local training, differential privacy, secure aggregation, and energy-aware orchestration for distributed model refinement where raw media or occupancy data should remain local. No further claim is drawn from these sources for accessibility outcomes. [5] [6] [7]

3. Established methodological precedents and their limits

Prior work establishes several transferable principles, but only within bounded domains. The indoor inspection framework demonstrates that a single continuous smartphone video can support metric-scale reconstruction, semantic parsing, and an evidence-linked assessment workflow in which computable risk prototypes are evaluated against a structured factual record. It also introduces a dual-pathway logic: an initial whole-environment scan followed by targeted follow-up queries when evidence remains incomplete. For the present protocol, those features justify a scene-based audit record and a second-stage evidence closure process. [1]

The construction-site study adds a complementary precedent. It registers site reality into a 3D model through point-cloud reconstruction and uses semantic segmentation to identify and visualize object categories relevant to safety management. The article also notes that occlusion and missing data are unavoidable during acquisition and may require reasoning from physical or process relationships. For accessibility audits, this precedent supports the use of point clouds or comparable 3D capture when object location, route obstruction, or spatial density must be recorded, while warning that incomplete capture is a persistent boundary condition. [2]

The belief-based BIM/digital-twin study is valuable because it formalizes uncertainty without disguising it as observed fact. Its Bayesian Network represents pooled expert beliefs, not measured project outcomes, and the study explicitly warns that optimistic beliefs may reflect contextual assumptions and selection bias. That caution is directly transferable: if this protocol uses Bayesian submodels to classify partial evidence, the outputs must be reported as inferred probabilities under stated assumptions rather than as empirical observations. [5]

The remaining two foundations are architectural rather than diagnostic. The smart-building sensing study argues that constant high-rate processing is often wasteful and proposes an event-driven hierarchy in which computation scales with environmental change. The federated-learning study argues that smart-environment models can be improved without sharing raw local data, though it also notes privacy, communication, heterogeneity, and energy constraints in IoT settings. In this protocol, these studies support optional monitoring and distributed learning components only; they do not demonstrate that such components improve accessibility auditing outcomes. [6] [7]

4. Conceptual model: task, channel, context, and evidence

The protocol defines accessibility at task level. A task is a property-relevant action required for ordinary building use, such as unlocking an entrance, calling a resident, confirming visitor identity, submitting a maintenance request, reading an evacuation instruction, or acknowledging a service interruption. A channel is the concrete means through which that task can be completed, for example a wall-mounted touch screen, a resident mobile application, a staffed desk, a voice intercom, or a web portal. Context is the surrounding physical and environmental situation at the point of use: route, reach, obstacle configuration, illumination, acoustic conditions, connectivity, and time-linked interface state.

An interface-in-context audit therefore evaluates a task-channel-context tuple rather than a device alone. This formulation sharpens two framing claims. First, the protocol is concerned only with tasks that are materially connected to occupancy, access, safety communication, or required property services. Second, a judgment about accessibility is admissible only if the evidence record can show both what the user had to do and the conditions under which the task had to be completed.

Each judgment is encoded through an Accessibility Prototype. This is the protocol’s proposed analogue to the computable risk prototype used in indoor inspection. An Accessibility Prototype contains nine fields: task identifier; task criticality class; primary channel; candidate alternative channels; user-demand profile set; spatial scope; mandatory observables; proxy-eligible observables; and decision rule. The criticality field separates essential tasks, whose failure can veto an otherwise favorable interface score, from ancillary tasks whose barriers matter but do not invalidate lawful or safe basic use. [1]

Scene representation is stored in a SceneState-style record adapted to accessibility. Minimum fields are: property identifier; interface identifier; task list; route-segment identifiers; geometric placement variables; detected obstacles; screenshots or screen-state records where lawful; environmental observations; source timestamps; capture modality; evidence-quality metadata; and links to every prototype evaluation. The record is designed so that later reviewers can retrieve the exact evidence supporting a finding, including the possibility that the finding is indeterminate.

5. Closed user-demand profile schema

A major source of unreliability in accessibility auditing is vague reference to user groups. This protocol therefore requires a closed profile schema. Each profile is a six-domain vector P = <V,H,S,Mf,Mr,C>, where V denotes vision, H hearing, S speech, Mf fine motor precision, Mr gross motor reach or mobility, and C cognitive-temporal tolerance. Each domain takes one of three ordinal levels: 0 = no declared limitation relevant to the task family; 1 = moderate limitation requiring common accommodation; 2 = substantial limitation under which the task must remain feasible through robust accommodation or an eligible alternative channel. Only these three levels are permitted in field use for a given protocol version.

The operational meaning of each level is fixed in advance. Vision level 1 indicates likely need for enlargement, stronger contrast, or glare reduction; level 2 means the task cannot rely on fine visual discrimination of the primary visual channel. Hearing level 1 indicates need for amplification or captioning; level 2 means essential auditory content cannot be assumed accessible. Speech level 1 means extended or highly precise speech interaction is unreliable; level 2 means the task cannot require speech production. Fine motor level 1 indicates difficulty with small targets or repeated tapping; level 2 means completion cannot depend on precise touch gestures. Gross motor reach or mobility level 1 indicates constrained reach or slower approach; level 2 means the task cannot assume unrestricted standing reach. Cognitive-temporal level 1 indicates need for simpler sequencing or longer timing; level 2 means the task cannot depend on short timeouts, memory-heavy branching, or complex recovery.

Profile assignment uses a source hierarchy and a unique mapping rule for validation. In planning audits, commissioning scope first declares which profile vectors are in scope for each task family. If participant-based walkthroughs are later used in validation, domain labels are assigned separately for each of the six domains from the strongest available source in this order: documented accommodation need, structured self-report, then predeclared adjudication notes. When sources disagree within a domain, the higher limitation level governs provisionally; two trained raters then review the evidence before testing, record a consensus domain level, and document the reason. If consensus is not reached, the higher level is retained and the case is flagged for sensitivity analysis. Field auditors do not infer person-specific profiles ad hoc during routine inspection; they apply predeclared profile vectors to prototypes. For validation, participant-to-profile matching is performed separately for each task attempt by a fixed function. Let A be the participant's six-domain assignment and S_t the preregistered set of in-scope vectors for task t. The admissible set is M_t(A) = {v in S_t : v <= A componentwise}. If M_t(A) is empty, the attempt is out of scope for profile-matched validity estimation. If M_t(A) is nonempty, select the unique matched vector v* that maximizes first the total demand score sum_d v_d, second the lexicographic order of domain levels using the fixed domain priority C > Mr > Mf > V > H > S, and third a permanently assigned protocol-wide vector code listed in the preregistration. This three-stage order yields one and only one matched vector for every compatible task attempt and does not vary by audit session, property, or assessor. The vector-code list and domain order are immutable within a version identified by a content hash. Filter by the preregistered task-family constraints before applying any tie-breaker; a vector outside that eligible set cannot win through its code. A changed codebook or eligibility list creates a new protocol version and a separate matching analysis. Codes only resolve equivalent permitted choices and do not rank the social significance of disabilities.

Task-specific profile selection follows a combination rule. A combined profile is included only if each constituent domain is independently relevant to at least one required interaction step of the task-channel pair. For example, combining vision level 2 with fine motor level 2 is justified for a touch-screen visitor kiosk only when both visual target recognition and precise touch activation are required. This rule prevents open-ended multiplication of hypothetical user types while preserving cases where interacting limitations materially change task feasibility.

For reporting, profiles are labeled by their six-value vectors rather than by broad population terms. A profile such as <2,0,0,2,1,0> states exactly which demands are under test and avoids the ambiguity of unspecific descriptors. The three-level coding is fixed during field use of a protocol version; later empirical work may revise domain definitions or mapping guidance only through an explicitly versioned protocol update rather than ad hoc case-level exceptions.

6. Variables, alternative-channel eligibility, and classification rules

The protocol groups variables into four classes. Spatial variables include route continuity, clear approach width, turning allowance, level change, queue-space depth, mounting height, reach depth, obstacle density, and support-fixture presence. Interface variables include available input and output modalities, target-size proxy, observable contrast proxy, timeout duration, step count, authentication modality, error recovery path, and persistence of state after interruption. Environmental variables include illumination or glare proxy, ambient noise, connectivity status, crowding, and where relevant extended-dwell environmental indicators. Evidence-quality variables include occlusion level, source type, capture completeness, timestamp alignment, and recency.

Because tasks may have several channels, the protocol uses a deterministic eligibility rule. A candidate alternative channel c counts as property-supported and realistically available for task t only if five conditions all hold: discoverability at the point of use or in directly supplied instructions; authorization parity, meaning no extra credential or prior registration beyond the task itself; activation independence from a person whose presence is uncertain; temporal reasonableness within a waiting constant D for the task class; and capability compatibility, meaning the channel does not impose a higher demand level in any relevant profile domain than the primary channel unless it is the only channel explicitly designated for that profile. The default rule is D = 300 s for entry, exit, intercom contact, and safety-alert acknowledgment tasks, and D = 1 business day for nonurgent service-request tasks. Sensitivity analyses should repeat classifications with D halved and doubled for each task class. Failing any condition excludes the channel from aggregation, although it remains documented.

The previous binary channel rule is replaced by a three-state classification with one default burden rule. Let F(t,p,c) be the number of critical barriers for task t, profile p, and eligible channel c, and let R(t,p,c) be the number of recoverable hindrances. The default operational constant is H = 0 for essential tasks and H = 1 for ancillary tasks. Channel status CAS3(t,p,c) is therefore 2 if F = 0 and R = 0; 1 if F = 0 and the task is ancillary and R = 1; and 0 if F > 0, if an essential task has any recoverable hindrance, if an ancillary task has R > 1, or if the channel is ineligible. Sensitivity analyses should repeat all classifications with H shifted by one admissible step for ancillary tasks, truncating at zero.

Task status is defined with an explicit empty-set rule. Let E(t,p) be the set of eligible channels for task t and profile p after application of the eligibility rule and the evidence-state process. If E(t,p) is empty, then TAS3(t,p) = 0. If E(t,p) is nonempty, TAS3(t,p) = max over c in E(t,p) of CAS3(t,p,c). This rule treats absence of any eligible and classifiable channel as task inaccessibility rather than leaving the task undefined. Interface status for interface i and profile p is summarized by AICI3(i,p) = [sum of w_t x TAS3(t,p)] / [2 x sum of w_t], where weights w_t are fixed at scoping and the denominator is positive only when at least one positive-weight task is in scope. If no positive-weight task is in scope, AICI3 is not computed. An essential-task veto applies: if any essential task has TAS3 = 0, the interface cannot be classified as fully accessible. Pending empirical calibration, the default classification constants are alpha = 0.85 and beta = 0.50. Thus, fully accessible requires no essential-task failure and AICI3 >= alpha; conditionally accessible requires no essential-task failure and beta <= AICI3 < alpha; otherwise the interface is inaccessible. Prospective validation should preregister sensitivity analyses for alpha in {0.80, 0.85, 0.90} and beta in {0.40, 0.50, 0.60}. The maximum is an explicit task-completion convention: one genuinely available complete channel can satisfy the task even when another channel fails. It does not claim that all channels are accessible. Report the conjunctive minimum across eligible channels and the number of passing independent channels as supplementary views. TAS3 codes 0, 1 and 2 are ordered categories, not a validated interval scale; division by two merely maps the largest code to one. Treat AICI3 as a descriptive coding-dependent index. Primary reporting includes the three-state distribution and essential-task failures, while sensitivity analysis varies the intermediate-state numerical code. Do not interpret a difference of 0.1 in AICI3 as a measured amount of human accessibility.

A critical barrier is any single condition that independently prevents completion for the specified profile through that channel. Examples proposed by the protocol include absence of a nonvisual route where the task depends entirely on fine visual discrimination for a vision level 2 profile; exclusive dependence on precise touch input for a fine motor level 2 profile; unreachable mounting height for a gross motor reach level 2 profile; or a timeout shorter than the prototype’s declared minimum for a cognitive-temporal level 2 profile when no pause or restart-preservation feature exists. Recoverable hindrances increase effort, delay, or error risk without independently blocking completion, such as glare that remains manageable after repositioning, or a noncritical timeout that permits easy restart without data loss. These categorizations are proposed and remain subject to later testing.

7. Evidence states, proxy admissibility, and deterministic-Bayesian order of operations

The protocol distinguishes three evidence states at the predicate level. Evidence is sufficient when all mandatory observables for a prototype are directly present in the audit record. Evidence is partial when one or more mandatory observables are missing but every missing variable has a prevalidated proxy listed in the prototype table, so that deterministic rules or Bayesian thresholding can still be attempted. Evidence is indeterminate when a mandatory observable lacks an admissible proxy, when direct and proxy indicators conflict beyond a predeclared tolerance, or when a Bayesian submodel returns a posterior between its positive and negative thresholds. Proxy tables are task-specific and must be frozen before field deployment. A task-channel case that remains indeterminate after all permitted follow-up capture has been attempted is assigned CAS3 = 0 by default for operational classification, but it is also tagged unresolved-evidence so that safety-critical conservatism is analytically distinguishable from directly observed failure. The conservative operational zero for unresolved evidence means that accessibility has not been established; it is not an observed barrier label. It requires follow-up or assistance and must not be used as an automated adverse decision about a person. Validation retains the unresolved-evidence state instead of recoding it as a measured failure.

Proxy admissibility is prototype-specific and must satisfy four advance criteria: mechanistic relevance to the missing variable; directional monotonicity within the stated context; reliable extraction from permitted capture modalities; and bounded validity limited to the listed task families, environments, and profile domains. This restriction is intended to prevent substitution of convenient but weak indicators across dissimilar interfaces or settings.

Contradiction beyond tolerance is also predeclared. For continuous variables, contradiction exists when direct and proxy-derived estimates differ by more than a prototype-specific tolerance delta. For ordinal variables, contradiction exists when direct evidence and proxy evidence imply nonadjacent states. For binary variables, contradiction exists whenever direct observation and proxy implication disagree. When contradiction occurs, direct observation governs if its evidence-quality score exceeds the prototype’s minimum quality floor; otherwise the case remains indeterminate and follow-up capture is requested.

The order of operations is fixed. Step A: determine channel eligibility. Step B: populate directly observed variables. Step C: run the deterministic prototype on direct evidence only; if direct evidence already establishes F > 0, classify the channel as inaccessible without Bayesian inference. Step D: only if mandatory variables needed to compute F or R remain missing, consult the prototype’s proxy table. Step E: instantiate a Bayesian submodel for each unresolved barrier family using specified direct parents and admissible proxies; observed variables are never replaced by estimated ones. Step F: use posterior outputs only to classify the previously missing barrier predicates, label those predicates as inferred, and rerun the deterministic prototype. Bayesian inference is therefore subordinate to deterministic rules and limited to unresolved mandatory predicates. [5]

The primary probabilistic baseline is a finite conditional Bernoulli table for each barrier family. Freeze the discretization of the direct-parent and proxy variables before calibration. Each table row corresponds to one prototype, task family, profile vector and registered parent/proxy configuration; rows are not pooled across those domains. On a calibration set disjoint by site and participant from evaluation, let b be the number of independently adjudicated barrier-present cases and n-b the barrier-absent cases in that row. Assign the proposed prior theta ~ Beta(1,1) and Bernoulli likelihood; the posterior is Beta(1+b,1+n-b), with predictive barrier probability q=(1+b)/(n+2). This is a modeling assumption, not a guarantee for a particular person. The baseline requires n >= 20 and a documented case-sampling design compatible with its conditional exchangeability assumption; otherwise the predicate remains unresolved. Repeated or dependent captures of the same case do not increase n. A more elaborate hierarchical or network model is an optional separately registered extension, not an unspecified substitute for this baseline. Infer barrier presence when q >= 0.80 and absence when q <= 0.20; intermediate values remain unresolved. Direct observations retain the precedence defined above. Tables, priors, bin boundaries and thresholds are versioned together and frozen during evaluation. New calibration requires a new version and fresh held-out testing. These sample and probability thresholds are proposed settings requiring empirical study.

8. Capture workflow and audit sequence

Field execution begins with scoping. Auditors declare property type, interfaces, tasks, task criticality, profile vectors, candidate channels, policy constants H, D, alpha, beta, and any Bayesian thresholds. They also declare permitted capture modalities and legal constraints on screen recording or media storage. This stage separates governance choices from later measurement, reducing ad hoc adjustment during inspection.

Capture then proceeds through a primary walkthrough. A continuous video or equivalent sequence records approach routes, waiting areas, device placement, surrounding fixtures, signage, and observable interface states. Where clutter, occlusion, or complex geometry makes two-dimensional review unreliable, supplementary point-cloud or comparable 3D capture may be added because three-dimensional registration can improve localization of objects, barriers, and route relationships. The construction-site literature supports this use of point-cloud-based semantic localization while also indicating that occlusion and data loss remain expected acquisition problems. The default field rule is to add 3D capture whenever a judgment depends on reach, clearance, turning space, or obstruction location and those variables cannot be resolved from calibrated video alone. [2]

Scene-state construction follows capture. The system reconstructs local geometry, anchors interfaces to route segments, associates each task with relevant evidence items, and stores environmental observations with timestamps. Consistent with the indoor inspection precedent, the resulting record must support targeted queries such as retrieval of all objects near a kiosk, all evidence related to a reach measurement, or all frames showing the instruction text at likely use distance. [1]

Prototype execution and follow-up querying complete the cycle. Deterministic rules run first; Bayesian inference is used only for unresolved mandatory predicates; any remaining indeterminate case triggers targeted recapture. Typical follow-up actions are measuring a disputed height, recapturing a reflective screen from a different angle, confirming whether captions or tactile controls exist, or verifying whether a stated fallback channel is discoverable at the point of use. This mirrors the indoor inspection study’s initial scan plus follow-up query logic while adapting it to accessibility barriers. [1]

9. Optional continuous monitoring and privacy-preserving distributed learning

Some audit variables are stable and suited to episodic inspection, but others vary materially over time. Ambient noise near a voice intercom, connectivity supporting a mobile credential, illumination at a lobby kiosk, or occupancy-related crowding may change enough to alter actual task feasibility. For such variables, the protocol allows an optional monitoring layer in which selected contextual signals are observed between full audits.

The monitoring design draws only an architectural lesson from prior work. The smart-building sensing study uses an event-driven hierarchy in which computation rises when environmental change is meaningful and falls when conditions are stable. Transferred cautiously, that logic suggests monitoring of accessibility-relevant context should be triggered by prototype-specific change events rather than constant high-rate processing. The source does not identify which accessibility variables should be monitored or what thresholds should govern alerts, so those parameters remain prospective protocol choices. [6]

When several properties seek to refine proxy models or barrier detectors, the protocol permits a federated-learning extension for distributed model training across locally held smart-environment data. The cited smart-environment framework keeps raw data local and shares model updates, with optional differential privacy, secure aggregation, and energy-aware scheduling. This is attractive where local evidence may include corridor imagery, visitor interactions, or service records that should not be pooled centrally. The same source also notes inversion risk, communication overhead, device heterogeneity, and power constraints; distributed learning is therefore treated as a guarded option rather than a default requirement. [7]

10. Comparator conditions, outcomes, and adjudicated reference standards

Because this manuscript is a protocol, its evaluation plan is prospective. The primary comparator is a conventional manual accessibility audit using checklist inspection without scene-based digital-twin reconstruction, evidence-linked storage, formal alternative-channel eligibility rules, or Bayesian treatment of partial evidence. A secondary comparator is a software-only review of screens or applications detached from the physical context of use. Any expectation that the proposed protocol will improve traceability, reproducibility, or barrier coverage remains a testable hypothesis rather than a reported result.

Primary outcome measures are proposed at four levels. Predicate level: agreement between observed or inferred barrier predicates and the adjudicated reference standard. Task level: recall of inaccessible task-channel pairs, false-positive rate for critical-barrier flags, proportion of conditionally accessible classifications, and closure rate for initially indeterminate cases after follow-up. Interface level: essential-task failure detection, profile-specific AICI3 scores, and remediation actionability, defined as the share of findings linked to a specific correctable condition. Process level: capture completeness, audit duration, privacy incidents, and cross-auditor reproducibility. No target values are asserted, and no evaluation result is reported here. Accuracy is reported selectively on cases with a conclusive reference and a conclusive system predicate, together with coverage over all reference-conclusive cases. The operational unresolved-zero is never counted as an observed positive in this accuracy analysis. For end-to-end critical-barrier recall, report lower and upper bounds by counting system-unresolved true-barrier cases as missed and detected, respectively. Reference-unresolved cases are excluded from every inferential accuracy denominator and retained in completeness and descriptive counts. Conditional accuracy without its coverage statistic is not a primary result.

Reference standards must be formalized and propagated through a fixed independence chain. In Phase 1, spatial measurement validity is assessed against two independent trained measurers who are blinded to the protocol's eventual accessibility classification thresholds, task criticality labels, and any prior system output. If their measurements fall within a predeclared tolerance, the mean is the reference; if not, a third senior measurer adjudicates and the reference becomes the median of the three unless one value is procedurally defective and excluded. In Phase 2, classification validity is assessed by a multidisciplinary review panel in accessibility, building inspection, and digital interfaces. Panelists receive the evidence record, the frozen prototype definitions, and the Phase 1 reference measurements, but they are blinded to the system's classification output, the tested comparator condition, and the interface-level weighting and threshold constants used for final operational aggregation. Task criticality is supplied because it is part of the prototype definition, yet panelists must classify each task-channel case at predicate and task level before any interface-level aggregation is computed. Each panelist rates cases independently. Cases are then resolved by consensus; if consensus fails, majority vote sets a provisional label and disagreement is retained as an uncertainty flag. Final reference labels must then respect the measurement chain: if a Phase 2 classification depends on a spatial variable that remained outside Phase 1 tolerance or on evidence judged procedurally defective, the final case label is not accessible or inaccessible but unresolved-reference, and it is excluded from accuracy estimation while retained for descriptive analysis. Reference measurements must come from a separate measurement exercise rather than from the algorithm’s extracted values. Panel access to task criticality is intentional because criticality defines the target construct; blinding applies to system predictions and comparator identity. The reference is therefore construct-conditioned expert adjudication, not an independent certification of legal compliance. Any unresolved spatial measurement propagates to all dependent reference predicates and task/interface accuracy estimates; it is not silently converted into an accessibility category.

Phase 3 evaluates ecological validity through observed task walkthroughs by participants matched to predeclared profile vectors using the unique assignment function stated earlier. Matching is performed per task attempt rather than once per audit session. If the session includes tasks associated with different vectors, each task attempt is scored against its own matched in-scope vector, and session summaries are then stratified by vector rather than pooled across incompatible vectors. Task success, assistance requirement, completion path, and observed burden are compared with protocol predictions. Phase 4 evaluates temporal stability and sensitivity by repeating selected audits under varying environmental conditions or after interface changes. If Phase 3 or Phase 4 observations contradict a prior provisional reference label, the contradiction does not retroactively overwrite Phase 1 or Phase 2; it is logged as a higher-level validity discrepancy requiring separate analysis of whether the prototype, thresholds, profile mapping, or capture assumptions were misspecified. These phases are proposed design elements, not completed studies. Joint sensitivity uses the Cartesian product of the preregistered alpha, beta, channel-waiting and posterior-threshold grids, retaining only valid ordered threshold pairs. Classify every case under every retained combination, report state-change frequencies and worst observed classification disagreement, and retain the registered reference configuration as primary. The sensitivity grid is not used to select a favorable result on the test set. Participant walkthroughs require prospective ethics review, informed consent and an approved assistance/stop procedure; none has been performed for this manuscript.

11. Failure cases, conflicting considerations, and limits of generalization

Several failure modes are foreseeable. Vision-based reconstruction may degrade in reflective, crowded, or poorly lit areas, and point-cloud workflows may suffer from occlusion and missing data. These limits matter because an inaccessible classification should not be an artifact of poor observation. The construction-site study explicitly notes unavoidable occlusion and data gaps, while the indoor inspection study shows that digital-twin assessment depends on the quality and completeness of the factual record and that context can affect performance. The protocol therefore requires evidence-quality metadata, minimum quality floors for contradiction resolution, and preservation of indeterminate status when capture is inadequate. [2] [1]

A second tension lies between formal inference and empirical caution. Bayesian submodels may improve handling of partial evidence, yet belief-based probabilities can create false confidence if treated as though they were validated causal laws. The belief-based BIM/digital-twin study repeatedly warns that expert-elicited probabilities represent informed beliefs under stated scenarios, not measured project effects. This protocol answers that concern by restricting Bayesian outputs to missing predicates, labeling them as inferred, and preserving indeterminate status where thresholds are not crossed. Whether that safeguard is sufficient remains to be tested. [5]

A third limitation concerns monitoring and privacy. Event-driven contextual monitoring may reduce unnecessary processing, but variables that are cheap to monitor may be weak indicators of accessibility. Federated learning may reduce central exposure of raw evidence, but the cited smart-environment study also notes inversion risk, communication overhead, device heterogeneity, and power constraints. Privacy-preserving distributed learning is therefore not assumed to be neutral or cost-free. [6] [7]

Generalization is intentionally narrow. The protocol is designed for smart property interfaces embedded in buildings where route, device, and local environmental conditions can be captured. It may be adapted to transport or public-service settings, but those environments introduce different queue dynamics, governance arrangements, and emergency obligations. The protocol is also weaker when critical interaction logic is hidden in proprietary remote systems, when legal restrictions preclude capture of key evidence, or when human mediation is so variable that no stable point-of-use channel can be defined.

12. Conclusion

This manuscript has established a conceptual and procedural framework for auditing smart property interfaces as interface-in-context systems rather than as isolated software artifacts. The central proposal is an evidence-constrained digital-twin process in which judgments depend on retrievable observations, predeclared prototypes, explicit alternative-channel rules, a closed user-demand profile schema, and a strict separation between observed predicates, inferred predicates, and unresolved cases.

The protocol’s main methodological contribution is a bounded specification of how such audits could be conducted reproducibly. It defines task, channel, context, and evidence units; formalizes channel eligibility; uses three accessibility states; sets default operational constants with preregistered sensitivity ranges; states admissibility criteria for proxies; fixes the order in which deterministic rules and Bayesian submodels are applied; and specifies a unique participant-to-profile matching function for later validation studies. It also gives adjudicated reference-standard procedures with blinding and independence conditions and a prospective validation design.

Substantial issues remain untested. These include measurement accuracy for accessibility-relevant spatial variables, practical validity of the closed profile schema, calibration of burden and waiting-time constants, predictive value and recalibration behavior of specific proxy sets, reliability across auditors, ecological correspondence with actual task performance, and comparative performance against manual or software-only audits. Continuous monitoring and distributed federated learning remain optional extensions whose accessibility value is unproven. The article should therefore be read as a research protocol: technically explicit and falsifiable, but not itself evidence of effectiveness. [1] [2] [5] [6] [7]

References

1. Jing, Zijian; Zhu, Liyi; Chen, Tianyi; Hovestadt, Ludger; Li, Li (2026). Vision-Based Digital Twin and AI Agent Framework for Low-Cost, Explainable Indoor Building Inspection and Safety Assessment. Sensors. 26(15), 4992. doi:10.3390/s26154992.
2. Qin, Wenli (2026). Application of construction site management based on digital twin and point cloud semantic segmentation technology. PLOS One. 21(3), e0340274. doi:10.1371/journal.pone.0340274.
3. World Wide Web Consortium (2024). Web Content Accessibility Guidelines (WCAG) 2.2. World Wide Web Consortium. Publisher record.
4. U.S. Access Board (2010). ADA Accessibility Standards: 2010 Department of Justice Standards and related technical provisions. U.S. Access Board. Publisher record.
5. Albtoush, Faten; Al-Btoosh, Ja’far A. Aldiabat; Rawashdeh, Taiseer Mustafa; Al-Btoush, Mohammed A. K. A. (2026). Assessing the impact of AI-enabled BIM digital twins on construction risks: a Bayesian Network of Jordanian expert beliefs. Frontiers in Artificial Intelligence. 9, 1846388. doi:10.3389/frai.2026.1846388.
6. De Jesus, Luigi Carlo M.; Africa, Aaron Don M.; Illahi, Ana Antoniette C.; Gustilo, Reggie C.; Brucal, Stanley Glenn E. (2026). Spike-Driven Neuromorphic Sensing for Energy-Proportional Indoor Air Quality Monitoring in Multi-Zone IoT-Enabled Smart Building Environments. Sensors. 26(13), 3992. doi:10.3390/s26133992.
7. Ramalingam, Venkadeshan; Kumar, Basant; Gupta, Shashi Kant; Alsekait, Deema Mohammed; AbdElminaam, Diaa Salama (2026). A hybrid federated learning framework with generative AI for privacy-preserving and sustainable security in IOT-enabled smart environments. Scientific Reports. 16(1), 3071. doi:10.1038/s41598-025-31769-6.